开源软件构建与测试

_service:extract_file:audit.spec Deleted

@@ -1,431 +0,0 @@
-Summary:            User space tools for kernel auditing
-Name:               audit
-Epoch:              1
-Version:            3.0.1
-Release:            2
-License:            GPLv2+ and LGPLv2+
-URL:                https://people.redhat.com/sgrubb/audit/
-Source0:            https://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
-Source1:            https://www.gnu.org/licenses/lgpl-2.1.txt
-
-Patch0:          bugfix-audit-support-armv7b.patch
-Patch1:          bugfix-audit-userspace-missing-syscalls-for-aarm64.patch
-Patch2:          bugfix-audit-reload-coredump.patch
-Patch3:          backport-Fix-the-default-location-for-zos-remote.conf-171.patch
-Patch4:          backport-Add-missing-call-to-free_interpretation_list.patch
-Patch5:          backport-fix-2-more-issues-found-by-fuzzing.patch
-Patch6:          backport-Fix-an-auparse-memory-leak-caused-in-recent-glibc.patch
-Patch7:          backport-Fix-double-free-with-corrupted-logs.patch
-Patch8:          backport-Fix-the-closing-timing-of-audit_fd-166.patch
-Patch9:          backport-Fix-some-string-length-issues.patch
-Patch10:         backport-Move-the-free_config-to-success-path.patch
-Patch11:         backport-Check-for-fuzzer-induced-invalid-value.patch
-Patch12:         backport-error-out-if-log-is-mangled.patch
-Patch13:         backport-Dont-run-off-the-end-with-corrupt-logs.patch
-Patch14:         backport-Another-hardening-measure-for-corrupted-logs.patch
-Patch15:         backport-Fix-busy-loop-in-normalizer-when-logs-are-corrupt.patch
-Patch16:         backport-Better-fix-for-busy-loop-in-normalizer-when-logs-are.patch
-Patch17:         backport-flush-uid-gid-caches-when-user-group-added-deleted-m.patch
-Patch18:         backport-In-auditd-check-if-log_file-is-valid-before-closing-.patch
-Patch19:         backport-Check-ctime-return-code.patch
-Patch20:         backport-When-interpreting-if-val-is-NULL-return-an-empty-str.patch
-Patch21:         backport-auditd.service-Restart-on-failure-ignoring-some-exit.patch
-Patch22:         backport-0001-In-auditd-close-the-logging-file-descriptor-when-log.patch
-Patch23:         backport-0002-In-auditd-close-the-logging-file-descriptor-when-log.patch
-
-BuildRequires:      gcc swig libtool systemd kernel-headers >= 2.6.29
-BuildRequires:      openldap-devel krb5-devel libcap-ng-devel
-%ifarch %{golang_arches}
-BuildRequires:      golang
-%endif
-Requires:           %{name}-libs = %{epoch}:%{version}-%{release}
-Requires(post):     systemd coreutils
-Requires(preun):    systemd
-Requires(postun):   systemd coreutils
-
-%description
-The audit package contains the user space utilities for storing and searching
-the audit records generated by the audit subsystem in the Linux 2.6 and later
-kernels.
-
-
-%package libs
-Summary: Dynamic library for libaudit
-License: LGPLv2+
-
-%description libs
-The audit-libs package contains the dynamic libraries needed for 
-applications to use the audit framework.
-
-%package -n audispd-plugins
-Summary: Plugins for audit event dispatcher
-License: GPLv2+
-Requires: %{name} = %{epoch}:%{version}-%{release}
-Requires: %{name}-libs = %{epoch}:%{version}-%{release}
-
-%description -n audispd-plugins
-This package provides plugins for the real-time interface to audispd.
-
-%package -n audispd-plugins-zos
-Summary: z/OS plugin for audit event dispatcher
-License: GPLv2+
-Requires: %{name} = %{epoch}:%{version}-%{release}
-Requires: %{name}-libs = %{epoch}:%{version}-%{release}
-Requires: openldap
-
-%description -n audispd-plugins-zos
-This package provides a z/OS plugin for audit event dispatcher that
-will forward audit events to a configured z/OS service management facility
-database.
-
-%package devel
-Summary:            Header files for libaudit
-License:            LGPLv2+
-Requires:           %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Requires:           kernel-headers >= 2.6.29
-Provides:           audit-libs-devel audit-libs-static
-
-%description devel
-The audit-libs-devel package contains the header files needed for developing
-applications that need to use the audit framework libraries.
-
-%package -n python3-audit
-Summary:            Python3 bindings for libaudit
-License:            LGPLv2+
-BuildRequires:      python3-devel
-Requires:           %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Provides:           audit-libs-python3 = %{version}-%{release}
-Provides:           audit-libs-python3%{?_isa} = %{version}-%{release}
-Obsoletes:          audit-libs-python3 < %{version}-%{release}
-
-%description -n python3-audit
-The python3-audit package contains the bindings so that libaudit and
-libauparse can be used by python3.
-
-%package_help
-
-%prep
-%autosetup -n %{name}-%{version} -p1
-cp %{SOURCE1} .
-autoreconf -f -i
-
-%build
-%configure --sbindir=/sbin --libdir=/%{_lib} --with-python=no \
-           --with-python3=yes \
-           --enable-gssapi-krb5=yes --with-arm --with-aarch64 \
-           --with-libcap-ng=yes --enable-zos-remote \
-%ifarch %{golang_arches}
-           --with-golang \
-%endif
-           --enable-systemd
-
-make CFLAGS="%{optflags}" %{?_smp_mflags}
-
-%install
-mkdir -p $RPM_BUILD_ROOT/{sbin,etc/audit/plugins.d,etc/audit/rules.d}
-mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
-mkdir -p $RPM_BUILD_ROOT/%{_lib}
-mkdir -p $RPM_BUILD_ROOT/%{_libdir}/audit
-mkdir -p --mode=0700 $RPM_BUILD_ROOT/%{_var}/log/audit
-mkdir -p $RPM_BUILD_ROOT/%{_var}/spool/audit
-make DESTDIR=$RPM_BUILD_ROOT install
-
-mkdir -p $RPM_BUILD_ROOT/%{_libdir}
-mv $RPM_BUILD_ROOT/%{_lib}/libaudit.a $RPM_BUILD_ROOT%{_libdir}
-mv $RPM_BUILD_ROOT/%{_lib}/libauparse.a $RPM_BUILD_ROOT%{_libdir}
-curdir=`pwd`
-cd $RPM_BUILD_ROOT/%{_libdir}
-LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libaudit.so.1.*.*\``
-ln -s ../../%{_lib}/$LIBNAME libaudit.so
-LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libauparse.so.0.*.*\``
-ln -s ../../%{_lib}/$LIBNAME libauparse.so
-cd $curdir
-rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.so
-rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
-
-find $RPM_BUILD_ROOT/%{_libdir}/python%{python3_version}/site-packages -name '*.a' -delete
-
-mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
-
-touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
-touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
-
-%delete_la
-
-%check
-%ifarch %{golang_arches}
-make check
-%endif
-rm -f rules/Makefile*
-
-%pre
-if  -d "/etc/audisp/" ;then
-    # custom plugins, copy config files from /etc/audisp/plugins.d to /etc/audit/plugins.d
-    # self-plugins confile files will be overwritten when installing
-    self_config_files_285=(syslog.conf au-remote.conf audispd-zos-remote.conf af_unix.conf)
-    plugins_config_files=`ls /etc/audisp/plugins.d/*.conf 2>/dev/null | wc -w`
-    if  $plugins_config_files -gt 0 ;then
-        if  ! -d /etc/audit/plugins.d/ ;then
-            mkdir -p /etc/audit/plugins.d/
-        fi
-
-        for file in `/usr/bin/ls /etc/audisp/plugins.d/*.conf`
-        do
-            if  " ${self_config_files_285} " =~ " `/usr/bin/basename $file` " ;then
-                continue
-            else
-                if  ! -f /etc/audit/plugins.d/`/usr/bin/basename $file` ;then
-                    cp $file /etc/audit/plugins.d/
-                fi
-            fi
-        done
-    fi
-fi
-
-%post
-/sbin/ldconfig
-files=`ls /etc/audit/rules.d/ 2>/dev/null | wc -w`
-if  "$files" -eq 0  ; then
-	if  -e /usr/share/doc/audit/rules/10-no-audit.rules  ; then
-	        cp /usr/share/doc/audit/rules/10-no-audit.rules /etc/audit/rules.d/audit.rules
-	else
-		touch /etc/audit/rules.d/audit.rules
-	fi
-	chmod 0600 /etc/audit/rules.d/audit.rules
-fi
-# merge custom changes to new file
-if  -d "/etc/audisp/" ;then
-    if  -s "/etc/audisp/plugins.d/af_unix.conf" ;then
-        diffrence=`diff /etc/audisp/plugins.d/af_unix.conf /etc/audit/plugins.d/af_unix.conf`

_service:tar_scm:audit.spec Added

@@ -0,0 +1,436 @@
+Summary:            User space tools for kernel auditing
+Name:               audit
+Epoch:              1
+Version:            3.0.1
+Release:            4
+License:            GPLv2+ and LGPLv2+
+URL:                https://people.redhat.com/sgrubb/audit/
+Source0:            https://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
+Source1:            https://www.gnu.org/licenses/lgpl-2.1.txt
+
+Patch0:          bugfix-audit-support-armv7b.patch
+Patch1:          bugfix-audit-userspace-missing-syscalls-for-aarm64.patch
+Patch2:          bugfix-audit-reload-coredump.patch
+Patch3:          backport-Fix-the-default-location-for-zos-remote.conf-171.patch
+Patch4:          backport-Add-missing-call-to-free_interpretation_list.patch
+Patch5:          backport-fix-2-more-issues-found-by-fuzzing.patch
+Patch6:          backport-Fix-an-auparse-memory-leak-caused-in-recent-glibc.patch
+Patch7:          backport-Fix-double-free-with-corrupted-logs.patch
+Patch8:          backport-Fix-the-closing-timing-of-audit_fd-166.patch
+Patch9:          backport-Fix-some-string-length-issues.patch
+Patch10:         backport-Move-the-free_config-to-success-path.patch
+Patch11:         backport-Check-for-fuzzer-induced-invalid-value.patch
+Patch12:         backport-error-out-if-log-is-mangled.patch
+Patch13:         backport-Dont-run-off-the-end-with-corrupt-logs.patch
+Patch14:         backport-Another-hardening-measure-for-corrupted-logs.patch
+Patch15:         backport-Fix-busy-loop-in-normalizer-when-logs-are-corrupt.patch
+Patch16:         backport-Better-fix-for-busy-loop-in-normalizer-when-logs-are.patch
+Patch17:         backport-flush-uid-gid-caches-when-user-group-added-deleted-m.patch
+Patch18:         backport-In-auditd-check-if-log_file-is-valid-before-closing-.patch
+Patch19:         backport-Check-ctime-return-code.patch
+Patch20:         backport-When-interpreting-if-val-is-NULL-return-an-empty-str.patch
+Patch21:         backport-auditd.service-Restart-on-failure-ignoring-some-exit.patch
+Patch22:         backport-0001-In-auditd-close-the-logging-file-descriptor-when-log.patch
+Patch23:         backport-0002-In-auditd-close-the-logging-file-descriptor-when-log.patch
+Patch24:         audit-Add-sw64-architecture.patch
+
+BuildRequires:      gcc swig libtool systemd kernel-headers >= 2.6.29
+BuildRequires:      openldap-devel krb5-devel libcap-ng-devel
+%ifarch %{golang_arches}
+BuildRequires:      golang
+%endif
+Requires:           %{name}-libs = %{epoch}:%{version}-%{release}
+Requires(post):     systemd coreutils
+Requires(preun):    systemd
+Requires(postun):   systemd coreutils
+
+%description
+The audit package contains the user space utilities for storing and searching
+the audit records generated by the audit subsystem in the Linux 2.6 and later
+kernels.
+
+
+%package libs
+Summary: Dynamic library for libaudit
+License: LGPLv2+
+
+%description libs
+The audit-libs package contains the dynamic libraries needed for 
+applications to use the audit framework.
+
+%package -n audispd-plugins
+Summary: Plugins for audit event dispatcher
+License: GPLv2+
+Requires: %{name} = %{epoch}:%{version}-%{release}
+Requires: %{name}-libs = %{epoch}:%{version}-%{release}
+
+%description -n audispd-plugins
+This package provides plugins for the real-time interface to audispd.
+
+%package -n audispd-plugins-zos
+Summary: z/OS plugin for audit event dispatcher
+License: GPLv2+
+Requires: %{name} = %{epoch}:%{version}-%{release}
+Requires: %{name}-libs = %{epoch}:%{version}-%{release}
+Requires: openldap
+
+%description -n audispd-plugins-zos
+This package provides a z/OS plugin for audit event dispatcher that
+will forward audit events to a configured z/OS service management facility
+database.
+
+%package devel
+Summary:            Header files for libaudit
+License:            LGPLv2+
+Requires:           %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+Requires:           kernel-headers >= 2.6.29
+Provides:           audit-libs-devel audit-libs-static
+
+%description devel
+The audit-libs-devel package contains the header files needed for developing
+applications that need to use the audit framework libraries.
+
+%package -n python3-audit
+Summary:            Python3 bindings for libaudit
+License:            LGPLv2+
+BuildRequires:      python3-devel
+Requires:           %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+Provides:           audit-libs-python3 = %{version}-%{release}
+Provides:           audit-libs-python3%{?_isa} = %{version}-%{release}
+Obsoletes:          audit-libs-python3 < %{version}-%{release}
+
+%description -n python3-audit
+The python3-audit package contains the bindings so that libaudit and
+libauparse can be used by python3.
+
+%package_help
+
+%prep
+%autosetup -n %{name}-%{version} -p1
+cp %{SOURCE1} .
+autoreconf -f -i
+
+%build
+%configure --sbindir=/sbin --libdir=/%{_lib} --with-python=no \
+           --with-python3=yes \
+           --enable-gssapi-krb5=yes --with-arm --with-aarch64 \
+           --with-libcap-ng=yes --enable-zos-remote \
+%ifarch %{golang_arches}
+           --with-golang \
+%endif
+           --enable-systemd
+
+make CFLAGS="%{optflags}" %{?_smp_mflags}
+
+%install
+mkdir -p $RPM_BUILD_ROOT/{sbin,etc/audit/plugins.d,etc/audit/rules.d}
+mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8}
+mkdir -p $RPM_BUILD_ROOT/%{_lib}
+mkdir -p $RPM_BUILD_ROOT/%{_libdir}/audit
+mkdir -p --mode=0700 $RPM_BUILD_ROOT/%{_var}/log/audit
+mkdir -p $RPM_BUILD_ROOT/%{_var}/spool/audit
+make DESTDIR=$RPM_BUILD_ROOT install
+
+mkdir -p $RPM_BUILD_ROOT/%{_libdir}
+mv $RPM_BUILD_ROOT/%{_lib}/libaudit.a $RPM_BUILD_ROOT%{_libdir}
+mv $RPM_BUILD_ROOT/%{_lib}/libauparse.a $RPM_BUILD_ROOT%{_libdir}
+curdir=`pwd`
+cd $RPM_BUILD_ROOT/%{_libdir}
+LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libaudit.so.1.*.*\``
+ln -s ../../%{_lib}/$LIBNAME libaudit.so
+LIBNAME=`basename \`ls $RPM_BUILD_ROOT/%{_lib}/libauparse.so.0.*.*\``
+ln -s ../../%{_lib}/$LIBNAME libauparse.so
+cd $curdir
+rm -f $RPM_BUILD_ROOT/%{_lib}/libaudit.so
+rm -f $RPM_BUILD_ROOT/%{_lib}/libauparse.so
+
+find $RPM_BUILD_ROOT/%{_libdir}/python%{python3_version}/site-packages -name '*.a' -delete
+
+mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
+
+touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf
+touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
+
+%delete_la
+
+%check
+make check
+rm -f rules/Makefile*
+
+%pre
+if  -d "/etc/audisp/" ;then
+    # custom plugins, copy config files from /etc/audisp/plugins.d to /etc/audit/plugins.d
+    # self-plugins confile files will be overwritten when installing
+    self_config_files_285=(syslog.conf au-remote.conf audispd-zos-remote.conf af_unix.conf)
+    plugins_config_files=`ls /etc/audisp/plugins.d/*.conf 2>/dev/null | wc -w`
+    if  $plugins_config_files -gt 0 ;then
+        if  ! -d /etc/audit/plugins.d/ ;then
+            mkdir -p /etc/audit/plugins.d/
+        fi
+
+        for file in `/usr/bin/ls /etc/audisp/plugins.d/*.conf`
+        do
+            if  " ${self_config_files_285} " =~ " `/usr/bin/basename $file` " ;then
+                continue
+            else
+                if  ! -f /etc/audit/plugins.d/`/usr/bin/basename $file` ;then
+                    cp $file /etc/audit/plugins.d/
+                fi
+            fi
+        done
+    fi
+fi
+
+%post
+/sbin/ldconfig
+files=`ls /etc/audit/rules.d/ 2>/dev/null | wc -w`
+if  "$files" -eq 0  ; then
+	if  -e /usr/share/doc/audit/rules/10-no-audit.rules  ; then
+	        cp /usr/share/doc/audit/rules/10-no-audit.rules /etc/audit/rules.d/audit.rules
+	else
+		touch /etc/audit/rules.d/audit.rules
+	fi
+	chmod 0600 /etc/audit/rules.d/audit.rules
+fi
+# merge custom changes to new file
+if  -d "/etc/audisp/" ;then
+    if  -s "/etc/audisp/plugins.d/af_unix.conf" ;then
+        diffrence=`diff /etc/audisp/plugins.d/af_unix.conf /etc/audit/plugins.d/af_unix.conf`
+        if  "X$diffrence" != "X" ;then

_service:extract_file:backport-0001-In-auditd-close-the-logging-file-descriptor-when-log.patch Deleted

_service:extract_file:backport-0002-In-auditd-close-the-logging-file-descriptor-when-log.patch Deleted

@@ -1,59 +0,0 @@
-From 770e4f538103f8a055f46c04a9e2514f88f175c3 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Mon, 1 Nov 2021 08:29:56 -0400
-Subject: PATCH 2244/2246 In auditd, close the logging file descriptor when
- logging is suspended
-
----
- src/auditd-event.c | 21 +++++++++++++++++++++
- 1 file changed, 21 insertions(+)
-
-diff --git a/src/auditd-event.c b/src/auditd-event.c
-index 4a0a351..e88ef6e 100644
---- a/src/auditd-event.c
-+++ b/src/auditd-event.c
-@@ -861,6 +861,13 @@ static void do_space_left_action(int admin)
- 		case FA_SUSPEND:
- 			audit_msg(LOG_ALERT,
- 			    "Audit daemon is suspending logging due to low disk space.");
-+			// We need to close the file so that manual
-+			// intervention can move or delete the file. We
-+			// don't want to keep logging to a deleted file.
-+			if (log_file)
-+				fclose(log_file);
-+			log_file = NULL;
-+			log_fd = -1;
- 			logging_suspended = 1;
- 			break;
- 		case FA_SINGLE:
-@@ -909,6 +916,13 @@ static void do_disk_full_action(void)
- 		case FA_SUSPEND:
- 			audit_msg(LOG_ALERT,
- 			    "Audit daemon is suspending logging due to no space left on logging partition.");
-+			// We need to close the file so that manual
-+			// intervention can move or delete the file. We
-+			// don't want to keep logging to a deleted file.
-+			if (log_file)
-+				fclose(log_file);
-+			log_file = NULL;
-+			log_fd = -1;
- 			logging_suspended = 1;
- 			break;
- 		case FA_SINGLE:
-@@ -957,6 +971,13 @@ static void do_disk_error_action(const char *func, int err)
- 		case FA_SUSPEND:
- 			audit_msg(LOG_ALERT,
- 			    "Audit daemon is suspending logging due to previously mentioned write error");
-+			// We need to close the file so that manual
-+			// intervention can move or delete the file. We
-+			// don't want to keep logging to a deleted file.
-+			if (log_file)
-+				fclose(log_file);
-+			log_file = NULL;
-+			log_fd = -1;
- 			logging_suspended = 1;
- 			break;
- 		case FA_SINGLE:
--- 
-1.8.3.1
-

_service:extract_file:backport-Add-missing-call-to-free_interpretation_list.patch Deleted

_service:extract_file:backport-Another-hardening-measure-for-corrupted-logs.patch Deleted

@@ -1,85 +0,0 @@
-From ab8f522953a56c860cac2cca2a7d7874419111d5 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Sat, 7 Aug 2021 13:13:19 -0400
-Subject: PATCH 2198/2246 Another hardening measure for corrupted logs
-
----
- src/ausearch-lookup.c |  3 +++
- src/ausearch-parse.c  | 25 +++++++++++++++----------
- 2 files changed, 18 insertions(+), 10 deletions(-)
-
-diff --git a/src/ausearch-lookup.c b/src/ausearch-lookup.c
-index e27c784..dd58c36 100644
---- a/src/ausearch-lookup.c
-+++ b/src/ausearch-lookup.c
-@@ -300,6 +300,9 @@ char *unescape(const char *buf)
- 		while (isxdigit(*ptr))
- 			ptr++;
- 	}
-+	if ((ptr - buf) == 0)
-+		return NULL;
-+
- 	str = strndup(buf, ptr - buf);
- 
- 	if (*buf == '(')
-diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
-index d051137..78dc44c 100644
---- a/src/ausearch-parse.c
-+++ b/src/ausearch-parse.c
-@@ -1658,12 +1658,21 @@ static int parse_sockaddr(const lnode *n, search_items *s)
- 	if (event_hostname || event_filename) {
- 		str = strstr(n->message, "saddr=");
- 		if (str) {
--			int len;
-+			unsigned int len = 0;
- 			struct sockaddr *saddr;
- 			char nameNI_MAXHOST;
- 
- 			str += 6;
--			len = strlen(str)/2;
-+			const char *ptr = str;
-+			if (*ptr == '(') {
-+				const char *ptr2 = strchr(ptr, ')');
-+				if (ptr2)
-+					len = (ptr2 - ptr) + 1;
-+			} else {
-+				while (isxdigit(ptrlen))
-+					len++;
-+				len /= 2;
-+			}
- 			s->hostname = unescape(str);
- 			if (s->hostname == NULL)
- 				return 4;
-@@ -1683,17 +1692,13 @@ static int parse_sockaddr(const lnode *n, search_items *s)
- 				}
- 				len = sizeof(struct sockaddr_in6);
- 			} else if (saddr->sa_family == AF_UNIX) {
--				struct sockaddr_un *un =
--					(struct sockaddr_un *)saddr;
--				if (un->sun_path0)
--					len = strlen(un->sun_path);
--				else // abstract name
--					len = strlen(&un->sun_path1);
--				if (len == 0) {
-+				if (len < 4) {
- 					fprintf(stderr,
- 						"sun_path len too short\n");
- 					return 3;
- 				}
-+				struct sockaddr_un *un =
-+					(struct sockaddr_un *)saddr;
- 				if (event_filename) {
- 					if (!s->filename) {
- 						//create
-@@ -1736,7 +1741,7 @@ static int parse_sockaddr(const lnode *n, search_items *s)
- 				s->hostname = NULL;
- 				return 0;
- 			}
--			if (getnameinfo(saddr, len, name, NI_MAXHOST, 
-+			if (getnameinfo(saddr, len, name, NI_MAXHOST,
- 					NULL, 0, NI_NUMERICHOST) ) {
- 				free(s->hostname);
- 				s->hostname = NULL;
--- 
-1.8.3.1
-

_service:extract_file:backport-Better-fix-for-busy-loop-in-normalizer-when-logs-are.patch Deleted

_service:extract_file:backport-Check-ctime-return-code.patch Deleted

@@ -1,47 +0,0 @@
-From fd76e380ea117000d9d350405e2cfbd070c5c01a Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Sat, 21 Aug 2021 10:18:30 -0400
-Subject: PATCH 2213/2246 Check ctime return code
-
----
- tools/aulast/aulast.c | 16 +++++++++++-----
- 1 file changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/tools/aulast/aulast.c b/tools/aulast/aulast.c
-index c513aac..8a25f3b 100644
---- a/tools/aulast/aulast.c
-+++ b/tools/aulast/aulast.c
-@@ -96,8 +96,11 @@ static void report_session(lnode* cur)
- 			int mins, hours, days;
- 			if (notime)
- 				printf("- %-7.5s", " ");
--			else
--				printf("- %-7.5s", ctime(&cur->end) + 11);
-+			else {
-+				char *ttime = ctime(&cur->end);
-+				printf("- %-7.5s", ttime ? ttime + 11 :
-+				       "bad value");
-+			}
- 			secs = cur->end - cur->start;
- 			mins  = (secs / 60) % 60;
- 			hours = (secs / 3600) % 24;
-@@ -128,10 +131,13 @@ static void report_session(lnode* cur)
- 		strftime(start, sizeof(start), "%x %T", btm);
- 		if (cur->end != 0) {
- 			btm = localtime(&cur->end);
--			strftime(end, sizeof(end), "%x %T", btm);
--		      printf("    ausearch --start %s --end %s",
--				start, end);
-+			if (btm) {
-+				strftime(end, sizeof(end), "%x %T", btm);
-+				printf("    ausearch --start %s --end %s",
-+					start, end);
-+			} else goto no_end;
- 		} else {
-+no_end:
- 		    printf("    ausearch --start %s", start);
- 		}
- 		if (cur->name == NULL)
--- 
-1.8.3.1
-

_service:extract_file:backport-Check-for-fuzzer-induced-invalid-value.patch Deleted

_service:extract_file:backport-Dont-run-off-the-end-with-corrupt-logs.patch Deleted

@@ -1,43 +0,0 @@
-From 50c65ae25e64b7bd4489ce22a4c7789fa9a81f2f Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Sat, 7 Aug 2021 11:33:20 -0400
-Subject: PATCH 2197/2246 Dont run off the end with corrupt logs
-
----
- src/ausearch-parse.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
-index 81ef319..d051137 100644
---- a/src/ausearch-parse.c
-+++ b/src/ausearch-parse.c
-@@ -1031,7 +1031,7 @@ static int parse_user(const lnode *n, search_items *s, anode *avc)
- 		if (str) {
- 			str += 5;
- 			term = str;
--			while (*term != ' ' && *term != ':')
-+			while (*term != ' ' && *term != ':' && *term)
- 				term++;
- 			if (term == str)
- 				return 24;
-@@ -1244,7 +1244,7 @@ skip:
- 				char *end = str;
- 				int legacy = 0;
- 
--				while (*end != ' ') {
-+				while (*end != ' ' && *end) {
- 					if (!isxdigit(*end)) {
- 						legacy = 1;
- 					}
-@@ -1295,7 +1295,7 @@ skip:
- 				char *end = str;
- 				int legacy = 0;
- 
--				while (*end != ' ') {
-+				while (*end != ' ' && *end) {
- 					if (!isxdigit(*end)) {
- 						legacy = 1;
- 					}
--- 
-1.8.3.1
-

_service:extract_file:backport-Fix-an-auparse-memory-leak-caused-in-recent-glibc.patch Deleted

@@ -1,35 +0,0 @@
-From 16246878c503d7395ae668817bf629e05361fec5 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Thu, 29 Jul 2021 18:39:22 -0400
-Subject: PATCH Fix an auparse memory leak caused in recent glibc
-
----
- auparse/interpret.c | 4 ++++-
- 1 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/auparse/interpret.c b/auparse/interpret.c
-index 2813acb..33c173e 100644
---- a/auparse/interpret.c
-+++ b/auparse/interpret.c
-@@ -50,6 +50,7 @@
- #include <sys/personality.h>
- #include <sys/prctl.h>
- #include <sched.h>
-+#include <limits.h>     /* PATH_MAX */
- #ifdef USE_FANOTIFY
- #include <linux/fanotify.h>
- #else
-@@ -865,8 +866,10 @@ static const char *print_escaped_ext(const idata *id)
- 			str1 = NULL;
- 		}
- 		errno = 0;
--		out = realpath(str3, NULL);
-+		out = malloc(PATH_MAX);
-+		realpath(str3, out);
- 		if (errno) { // If there's an error, just return the original
-+			free(out);
- 			free(str1);
- 			free(str2);
- 			return str3;
--- 
-

_service:extract_file:backport-Fix-busy-loop-in-normalizer-when-logs-are-corrupt.patch Deleted

_service:extract_file:backport-Fix-double-free-with-corrupted-logs.patch Deleted

_service:extract_file:backport-Fix-some-string-length-issues.patch Deleted

@@ -1,64 +0,0 @@
-From 39f868fef95f95786358bc3690a327d4f11d2d43 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Thu, 3 Jun 2021 16:18:36 -0400
-Subject: PATCH 2084/2246 Fix some string length issues
-
-In interpret, fix the size so that we need to size it again later if new
-strings get added. The ausearch/report issues have the size information
-available, so FORTIFY_SOURCE should keep things in check.
----
- auparse/interpret.c | 2 +-
- src/aureport.c      | 4 ++--
- src/ausearch.c      | 4 ++--
- 3 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/auparse/interpret.c b/auparse/interpret.c
-index e22cae7..5d6f31a 100644
---- a/auparse/interpret.c
-+++ b/auparse/interpret.c
-@@ -1242,7 +1242,7 @@ static const char *print_flags(const char *val)
- {
-         int flags, cnt = 0;
- 	size_t i;
--	char *out, buf80;
-+	char *out, bufsizeof(flag_strings);
- 
-         errno = 0;
-         flags = strtoul(val, NULL, 16);
-diff --git a/src/aureport.c b/src/aureport.c
-index d0251a4..22618f0 100644
---- a/src/aureport.c
-+++ b/src/aureport.c
-@@ -168,10 +168,10 @@ static int process_logs(void)
- 	int num = 0;
- 
- 	if (user_file && userfile_is_dir) {
--		char dirnameMAXPATHLEN;
-+		char dirnameMAXPATHLEN+1;
- 		clear_config (&config);
- 
--		strcpy(dirname, user_file);
-+		strncpy(dirname, user_file, MAXPATHLEN-32);
- 		if (dirnamestrlen(dirname)-1 != '/')
- 			strcat(dirname, "/");
- 		strcat (dirname, "audit.log");
-diff --git a/src/ausearch.c b/src/ausearch.c
-index 97f89bf..768807e 100644
---- a/src/ausearch.c
-+++ b/src/ausearch.c
-@@ -228,10 +228,10 @@ static int process_logs(void)
- 	int ret;
- 
- 	if (user_file && userfile_is_dir) {
--		char dirnameMAXPATHLEN;
-+		char dirnameMAXPATHLEN+1;
- 		clear_config (&config);
- 
--		strcpy(dirname, user_file);
-+		strncpy(dirname, user_file, MAXPATHLEN-32);
- 		if (dirnamestrlen(dirname)-1 != '/')
- 				strcat(dirname, "/");
- 		strcat (dirname, "audit.log");
--- 
-1.8.3.1
-

_service:extract_file:backport-Fix-the-closing-timing-of-audit_fd-166.patch Deleted

_service:extract_file:backport-Fix-the-default-location-for-zos-remote.conf-171.patch Deleted

@@ -1,37 +0,0 @@
-From ea21005f1abba62ed4acd7432c6e721504909511 Mon Sep 17 00:00:00 2001
-From: Pythoner <yixiangzhike007@163.com>
-Date: Mon, 19 Apr 2021 14:10:14 -0500
-Subject: PATCH 2052/2052 Fix the default location for zos-remote.conf (#171)
-
----
- audisp/plugins/zos-remote/audispd-zos-remote.conf | 2 +-
- docs/zos-remote.conf.5                            | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/audisp/plugins/zos-remote/audispd-zos-remote.conf b/audisp/plugins/zos-remote/audispd-zos-remote.conf
-index 13aef2c..eda199e 100644
---- a/audisp/plugins/zos-remote/audispd-zos-remote.conf
-+++ b/audisp/plugins/zos-remote/audispd-zos-remote.conf
-@@ -10,5 +10,5 @@ active = no
- direction = out
- path = /sbin/audispd-zos-remote
- type = always 
--args = /etc/audisp/zos-remote.conf
-+args = /etc/audit/zos-remote.conf
- format = string
-diff --git a/docs/zos-remote.conf.5 b/docs/zos-remote.conf.5
-index 4bf504d..7ee92e3 100644
---- a/docs/zos-remote.conf.5
-+++ b/docs/zos-remote.conf.5
-@@ -26,7 +26,7 @@ zos\-remote.conf \- the audisp-racf plugin configuration file
- controls the configuration for the
- .BR audispd\-zos\-remote (8)
- Audit dispatcher plugin. The default location for this file is
--.IR /etc/audisp/zos\-remote.conf ,
-+.IR /etc/audit/zos\-remote.conf ,
- however, a different file can be specified as the first argument to the
- .B audispd\-zos\-remote
- plugin. See
--- 
-1.8.3.1
-

_service:extract_file:backport-In-auditd-check-if-log_file-is-valid-before-closing-.patch Deleted

@@ -1,135 +0,0 @@
-From 6531c7dfb832ea245d8004662ea7c4e90107c0df Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Wed, 11 Aug 2021 15:10:18 -0400
-Subject: PATCH 2207/2246 In auditd, check if log_file is valid before
- closing handle
-
----
- src/auditd-event.c | 44 +++++++++++++++++++++++++++++++----------------
- 1 files changed, 29 insertions(+), 15 deletions(-)
-
-diff --git a/src/auditd-event.c b/src/auditd-event.c
-index 3655726..788c44a 100644
---- a/src/auditd-event.c
-+++ b/src/auditd-event.c
-@@ -71,7 +71,7 @@ static void init_flush_thread(void);
- /* Local Data */
- static struct daemon_conf *config;
- static volatile int log_fd;
--static FILE *log_file;
-+static FILE *log_file = NULL;
- static unsigned int disk_err_warning = 0;
- static int fs_space_warning = 0;
- static int fs_admin_space_warning = 0;
-@@ -174,7 +175,8 @@ int init_event(struct daemon_conf *conf)
- 	format_buf = (char *)malloc(FORMAT_BUF_LEN);
- 	if (format_buf == NULL) {
- 		audit_msg(LOG_ERR, "No memory for formatting, exiting");
--		fclose(log_file);
-+		if (log_file)
-+			fclose(log_file);
- 		log_file = NULL;
- 		return 1;
- 	}
-@@ -212,7 +214,8 @@ static void *flush_thread_main(void *arg)
- 		flush = 0;
- 		pthread_mutex_unlock(&flush_lock);
- 
--		fsync(log_fd);
-+		if (log_fd >= 0)
-+			fsync(log_fd);
- 	}
- 	return NULL;
- }
-@@ -589,7 +592,8 @@ void handle_event(struct auditd_event *e)
- 				if (config->daemonize == D_BACKGROUND) {
- 					if (config->flush == FT_INCREMENTAL) {
- 						/* EIO is only likely failure */
--						if (fsync(log_fd) != 0) {
-+						if (log_fd >= 0 &&
-+							fsync(log_fd) != 0) {
- 						     do_disk_error_action(
- 							"fsync",
- 							errno);
-@@ -744,6 +748,9 @@ static void check_space_left(void)
- 	int rc;
- 	struct statfs buf;
- 
-+	if (log_fd < 0)
-+		return;
-+
-         rc = fstatfs(log_fd, &buf);
-         if (rc == 0) {
- 		if (buf.f_bavail < 5) {
-@@ -831,7 +838,8 @@ static void do_space_left_action(int admin)
- 		case FA_EXEC:
- 			// Close the logging file in case the script zips or
- 			// moves the file. We'll reopen in sigusr2 handler
--			fclose(log_file);
-+			if (log_file)
-+				fclose(log_file);
- 			log_file = NULL;
- 			log_fd = -1;
- 			logging_suspended = 1;
-@@ -881,7 +889,8 @@ static void do_disk_full_action(void)
- 		case FA_EXEC:
- 			// Close the logging file in case the script zips or
- 			// moves the file. We'll reopen in sigusr2 handler
--			fclose(log_file);
-+			if (log_file)
-+				fclose(log_file);
- 			log_file = NULL;
- 			log_fd = -1;
- 			logging_suspended = 1;
-@@ -928,7 +937,8 @@ static void do_disk_error_action(const char *func, int err)
- 		case FA_EXEC:
- 			// Close the logging file in case the script zips or
- 			// moves the file. We'll reopen in sigusr2 handler
--			fclose(log_file);
-+			if (log_file)
-+				fclose(log_file);
- 			log_file = NULL;
- 			log_fd = -1;
- 			logging_suspended = 1;
-@@ -1053,17 +1063,21 @@ static void rotate_logs(unsigned int num_logs, unsigned int keep_logs)
- 	/* Close audit file. fchmod and fchown errors are not fatal because we
- 	 * already adjusted log file permissions and ownership when opening the
- 	 * log file. */
--	if (fchmod(log_fd, config->log_group ? S_IRUSR|S_IRGRP : S_IRUSR) < 0){
--		audit_msg(LOG_WARNING, "Couldn't change permissions while "
-+	if (log_fd >= 0) {
-+		if (fchmod(log_fd, config->log_group ? S_IRUSR|S_IRGRP :
-+			  S_IRUSR) < 0){
-+		    audit_msg(LOG_WARNING, "Couldn't change permissions while "
- 			"rotating log file (%s)", strerror(errno));
--	}
--	if (fchown(log_fd, 0, config->log_group) < 0) {
--		audit_msg(LOG_WARNING, "Couldn't change ownership while "
-+		}
-+		if (fchown(log_fd, 0, config->log_group) < 0) {
-+		    audit_msg(LOG_WARNING, "Couldn't change ownership while "
- 			"rotating log file (%s)", strerror(errno));
-+		}
- 	}
--	fclose(log_file);
-+	if (log_file)
-+		fclose(log_file);
- 	log_file = NULL;
--	
-+
- 	/* Rotate */
- 	len = strlen(config->log_file) + 16;
- 	oldname = (char *)malloc(len);
-@@ -1470,7 +1484,8 @@ static void reconfigure(struct auditd_event *e)
- 		free((void *)nconf->log_file);
- 
- 	if (need_reopen) {
--		fclose(log_file);
-+		if (log_file)
-+			fclose(log_file);
- 		log_file = NULL;
- 		fix_disk_permissions();
- 		if (open_audit_log()) {
--- 
-1.8.3.1
-

_service:extract_file:backport-Move-the-free_config-to-success-path.patch Deleted

_service:extract_file:backport-When-interpreting-if-val-is-NULL-return-an-empty-str.patch Deleted

_service:extract_file:backport-auditd.service-Restart-on-failure-ignoring-some-exit.patch Deleted

@@ -1,35 +0,0 @@
-From 30382bfcc0f64f451bc084c9657a546cb34492a7 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= <travier@redhat.com>
-Date: Fri, 1 Oct 2021 16:35:57 +0200
-Subject: PATCH 2228/2246 auditd.service: Restart 'on-failure', ignoring some
- exit codes (#217)
-
-Use `Restart=on-failure` to automatically restart `auditd`. Do not
-restart for intentional exits. See EXIT CODES section in auditd(8).
-
-See:
-- https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=
-- https://www.freedesktop.org/software/systemd/man/systemd.service.html#RestartPreventExitStatus=
-
-Fixes: https://github.com/linux-audit/audit-userspace/issues/211
----
- init.d/auditd.service | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/init.d/auditd.service b/init.d/auditd.service
-index 67cda58..e801281 100644
---- a/init.d/auditd.service
-+++ b/init.d/auditd.service
-@@ -27,6 +27,9 @@ ExecStartPost=-/sbin/augenrules --load
- # By default we don't clear the rules on exit. To enable this, uncomment
- # the next line after copying the file to /etc/systemd/system/auditd.service
- #ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
-+Restart=on-failure
-+# Do not restart for intentional exits. See EXIT CODES section in auditd(8).
-+RestartPreventExitStatus=2 4 6
- 
- ### Security Settings ###
- MemoryDenyWriteExecute=true
--- 
-1.8.3.1
-

_service:extract_file:backport-error-out-if-log-is-mangled.patch Deleted

_service:extract_file:backport-fix-2-more-issues-found-by-fuzzing.patch Deleted

@@ -1,46 +0,0 @@
-From f4683d04eadb7d76b98497af834f027d6005d893 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Mon, 9 Aug 2021 17:14:17 -0400
-Subject: PATCH fix 2 more issues found by fuzzing
-
----
- auparse/auparse.c | 8 +++++++-
- auparse/ellist.c  | 4 +++-
- 2 files changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/auparse/auparse.c b/auparse/auparse.c
-index b0e685a..3cf512a 100644
---- a/auparse/auparse.c
-+++ b/auparse/auparse.c
-@@ -1611,7 +1611,13 @@ static int au_auparse_next_event(auparse_state_t *au)
- 		}
- 		aup_list_create(l);
- 		aup_list_set_event(l, &e);
--		aup_list_append(l, au->cur_buf, au->list_idx, au->line_number);
-+		if (aup_list_append(l, au->cur_buf, au->list_idx,
-+				    au->line_number) < 0) {
-+			au->cur_buf = NULL;
-+			aup_list_clear(l);
-+			free(l);
-+			continue;
-+		}
- 		// Eat standalone EOE - main event was already marked complete
- 		if (l->head->type == AUDIT_EOE) {
- 			au->cur_buf = NULL;
-diff --git a/auparse/ellist.c b/auparse/ellist.c
-index 7d9c552..dd711bc 100644
---- a/auparse/ellist.c
-+++ b/auparse/ellist.c
-@@ -290,7 +290,9 @@ static int parse_up_record(rnode* r)
- 					while (ptr && *ptr != '}') {
- 						len = strlen(ptr);
- 						if ((len+1) >= (256-total)) {
--							free(buf);
-+						   if (nvlist_get_cnt(&r->nv)
-+									 == 0)
-+								free(buf);
- 							return -1;
- 						}
- 						if (tmpctx0) {
--- 
-

_service:extract_file:backport-flush-uid-gid-caches-when-user-group-added-deleted-m.patch Deleted

@@ -1,128 +0,0 @@
-From 8662f61108f8b9365f96ef49ca8ca331a7880f24 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Tue, 10 Aug 2021 11:27:16 -0400
-Subject: PATCH 2205/2246 flush uid/gid caches when user/group
- added/deleted/modified
-
-It was reported in issue #209 that in the enriched format that auditd
-is creating the wrong account associations. This is due to caching
-previous lookups. The fix is to monitor for account lifecycle changes
-and flush the LRUs if any are seen.
----
- auparse/auparse-idata.h |  3 ++-
- auparse/interpret.c     | 12 ++++++++++++
- src/auditd-event.c      | 27 +++++++++++++++++++++++++--
- 3 files changed, 39 insertions(+), 3 deletions(-)
-
-diff --git a/auparse/auparse-idata.h b/auparse/auparse-idata.h
-index 660901a..eaca86a 100644
---- a/auparse/auparse-idata.h
-+++ b/auparse/auparse-idata.h
-@@ -1,6 +1,6 @@
- /*
- * idata.h - Header file for ausearch-lookup.c
--* Copyright (c) 2013,2016-17 Red Hat Inc., Durham, North Carolina.
-+* Copyright (c) 2013,2016-17,2021 Red Hat Inc.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
-@@ -45,6 +45,7 @@ char *auparse_do_interpretation(int type, const idata *id,
- void _auparse_load_interpretations(const char *buf);
- void _auparse_free_interpretations(void);
- const char *_auparse_lookup_interpretation(const char *name);
-+void _auparse_flush_caches(void);
- 
- #endif
- 
-diff --git a/auparse/interpret.c b/auparse/interpret.c
-index 046867b..eef377a 100644
---- a/auparse/interpret.c
-+++ b/auparse/interpret.c
-@@ -653,6 +653,18 @@ void aulookup_destroy_gid_list(void)
- 	gid_cache_created = 0;
- }
- 
-+void _auparse_flush_caches(void)
-+{
-+	if (uid_cache_created) {
-+		destroy_lru(uid_cache);
-+		uid_cache_created = 0;
-+	}
-+	if (gid_cache_created) {
-+		destroy_lru(gid_cache);
-+		gid_cache_created = 0;
-+	}
-+}
-+
- static const char *print_uid(const char *val, unsigned int base)
- {
-         int uid;
-diff --git a/src/auditd-event.c b/src/auditd-event.c
-index cb29fee..3655726 100644
---- a/src/auditd-event.c
-+++ b/src/auditd-event.c
-@@ -42,6 +42,7 @@
- #include "libaudit.h"
- #include "private.h"
- #include "auparse.h"
-+#include "auparse-idata.h"
- 
- /* This is defined in auditd.c */
- extern volatile int stop;
-@@ -56,7 +57,7 @@ static void do_space_left_action(int admin);
- static void do_disk_full_action(void);
- static void do_disk_error_action(const char *func, int err);
- static void fix_disk_permissions(void);
--static void check_excess_logs(void); 
-+static void check_excess_logs(void);
- static void rotate_logs_now(void);
- static void rotate_logs(unsigned int num_logs, unsigned int keep_logs);
- static void shift_logs(void);
-@@ -394,7 +395,7 @@ static const char *format_enrich(const struct audit_reply *rep)
- 	        	snprintf(format_buf, MAX_AUDIT_MESSAGE_LENGTH,
- 		    "type=DAEMON_ERR op=format-enriched msg=NULL res=failed");
- 	} else {
--		int rc;
-+		int rc, rtype;
- 		size_t mlen, len;
- 		char *message;
- 		// Do raw format to get event started
-@@ -427,6 +428,17 @@ static const char *format_enrich(const struct audit_reply *rep)
- 
- 		// Loop over all fields while possible to add field
- 		rc = auparse_first_record(au);
-+		rtype = auparse_get_type(au);
-+		switch (rtype)
-+		{	// Flush before adding to pickup new associations
-+			case AUDIT_ADD_USER:
-+			case AUDIT_ADD_GROUP:
-+				_auparse_flush_caches();
-+				break;
-+			default:
-+				break;
-+		}
-+
- 		while (rc > 0 && len > MIN_SPACE_LEFT) {
- 			// See what kind of field we have
- 			size_t vlen;
-@@ -454,6 +466,17 @@ static const char *format_enrich(const struct audit_reply *rep)
- 			rc = auparse_next_field(au);
- 		}
- 
-+		switch(rtype)
-+		{	// Flush after modification to remove stale entries
-+			case AUDIT_USER_MGMT:
-+			case AUDIT_DEL_USER:
-+			case AUDIT_DEL_GROUP:
-+			case AUDIT_GRP_MGMT:
-+				_auparse_flush_caches();
-+				break;
-+			default:
-+				break;
-+		}
- 		free(message);
- 	}
-         return format_buf;
--- 
-1.8.3.1
-

_service:extract_file:bugfix-audit-reload-coredump.patch Deleted

@@ -1,99 +0,0 @@
-From 2a7404291e431757bc417c9c3250f2ca84a82d89 Mon Sep 17 00:00:00 2001
-From: Leo Fang <leofang_94@163.com>
-Date: Mon, 24 May 2021 19:16:02 +0800
-Subject: PATCH bugfix-audit-reload-coredump
-
----
- src/auditd-reconfig.c |  2 ++
- src/auditd.c          | 36 +++++++++++++++++++++++++++++-------
- 2 files changed, 31 insertions(+), 7 deletions(-)
-
-diff --git a/src/auditd-reconfig.c b/src/auditd-reconfig.c
-index f5b00e6..5ea9126 100644
---- a/src/auditd-reconfig.c
-+++ b/src/auditd-reconfig.c
-@@ -35,6 +35,7 @@
- 
- /* externs we need to know about */
- extern void reconfig_ready(void);
-+extern void reconfig_pthread_failed(void);
- 
- /* This is the configuration manager code */
- static pthread_t config_thread;
-@@ -122,6 +123,7 @@ static void *config_thread_main(void *arg)
- 		//send_audit_event(AUDIT_DAEMON_CONFIG, txt);
- 		free_config(&new_config);
- 		free(e);
-+		reconfig_pthread_failed();
- 	}
- 
- 	pthread_mutex_unlock(&config_lock);
-diff --git a/src/auditd.c b/src/auditd.c
-index fa783a2..0d76e0c 100644
---- a/src/auditd.c
-+++ b/src/auditd.c
-@@ -76,6 +76,7 @@ static int hup_info_requested = 0;
- static int usr1_info_requested = 0, usr2_info_requested = 0;
- static char subjSUBJ_LEN;
- static uint32_t session;
-+static int hup_flag = 0;
- 
- /* Local function prototypes */
- int send_audit_event(int type, const char *str);
-@@ -519,15 +520,30 @@ static void netlink_handler(struct ev_loop *loop, struct ev_io *io,
- 				char hupMAX_AUDIT_MESSAGE_LENGTH;
- 				audit_msg(LOG_DEBUG,
- 				    "HUP detected, starting config manager");
--				reconfig_ev = cur_event;
--				if (start_config_manager(cur_event)) {
-+				if(hup_flag == 0)
-+				{
-+					hup_flag = 1;
-+					reconfig_ev = cur_event;
-+					if (start_config_manager(cur_event)) {
-+						audit_format_signal_info(hup,
-+								 	sizeof(hup),
-+						 	"reconfigure state=no-change",
-+							 	&cur_event->reply,
-+								 	"failed");
-+						send_audit_event(AUDIT_DAEMON_CONFIG,
-+							 	hup);
-+						hup_flag = 0;
-+					}
-+				}
-+				else
-+				{
- 					audit_format_signal_info(hup,
--								 sizeof(hup),
--						 "reconfigure state=no-change",
--							 &cur_event->reply,
--								 "failed");
-+							 	sizeof(hup),
-+					 	"reconfigure state=no-change",
-+						 	&cur_event->reply,
-+							 	"failed");
- 					send_audit_event(AUDIT_DAEMON_CONFIG,
--							 hup);
-+						 	hup);
- 				}
- 				cur_event = NULL;
- 				hup_info_requested = 0;
-@@ -571,9 +587,15 @@ static void pipe_handler(struct ev_loop *loop, struct ev_io *io,
- 	// Drain the pipe - won't block because libev sets non-blocking mode
- 	read(pipefds0, buf, sizeof(buf));
- 	enqueue_event(reconfig_ev);
-+	hup_flag = 0;
- 	reconfig_ev = NULL;
- }
- 
-+void reconfig_pthread_failed(void)
-+{
-+	hup_flag = 0;
-+}
-+
- void reconfig_ready(void)
- {
- 	const char *msg = "ready\n";
--- 
-1.8.3.1
-

_service:extract_file:bugfix-audit-support-armv7b.patch Deleted

_service:extract_file:bugfix-audit-userspace-missing-syscalls-for-aarm64.patch Deleted

@@ -1,67 +0,0 @@
-From ad68debcab63df34dc7b1fc4b4fd4fc4f01b8d7c Mon Sep 17 00:00:00 2001
-From: jinbo <jinbo8@huawei.com>
-Date: Mon, 12 Nov 2018 21:54:29 +0800
-Subject: PATCH audit: userspace missing syscalls for aarm64
-
-API_change: n
-reason: reconsitution userspace audit missing syscalls for aarm64
-
-Signed-off-by: jinbo <jinbo8@huawei.com>
----
- lib/aarch64_table.h | 43 +++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 43 insertions(+)
-
-diff --git a/lib/aarch64_table.h b/lib/aarch64_table.h
-index c61aa91..ea634c1 100644
---- a/lib/aarch64_table.h
-+++ b/lib/aarch64_table.h
-@@ -311,3 +311,46 @@ _S(438, "pidfd_getfd")
- _S(439, "faccessat2")
- _S(440, "process_madvise")
- _S(441, "epoll_pwait2")
-+_S(1024, "open")
-+_S(1025, "link")
-+_S(1026, "unlink")
-+_S(1027, "mknod")
-+_S(1028, "chmod")
-+_S(1029, "chown")
-+_S(1030, "mkdir")
-+_S(1031, "rmdir")
-+_S(1032, "lchown")
-+_S(1033, "access")
-+_S(1034, "rename")
-+_S(1035, "readlink")
-+_S(1036, "symlink")
-+_S(1037, "utimes")
-+_S(1038, "stat64")
-+_S(1039, "lstat64")
-+_S(1040, "pipe")
-+_S(1041, "dup2")
-+_S(1042, "epoll_create")
-+_S(1043, "inotify_init")
-+_S(1044, "eventfd")
-+_S(1045, "signalfd")
-+_S(1049, "newstat")
-+_S(1050, "newlstat")
-+_S(1059, "alarm")
-+_S(1060, "getpgrp")
-+_S(1061, "pause")
-+_S(1062, "time")
-+_S(1063, "utime")
-+_S(1064, "creat")
-+_S(1066, "futimesat")
-+_S(1067, "select")
-+_S(1068, "poll")
-+_S(1069, "epoll_wait")
-+_S(1070, "ustat")
-+_S(1071, "vfork")
-+_S(1073, "recv")
-+_S(1074, "send")
-+_S(1075, "bdflush")
-+_S(1076, "oldumount")
-+_S(1077, "uselib")
-+_S(1078, "sysctl")
-+_S(1079, "fork")
--- 
-1.8.5.6
-

_service:tar_scm:audit-Add-sw64-architecture.patch Added

@@ -0,0 +1,113 @@
+From df547703bb90026dcff152e64bc55503ad26d815 Mon Sep 17 00:00:00 2001
+From: wuzx <wuzx1226@qq.com>
+Date: Fri, 18 Nov 2022 13:19:49 +0800
+Subject: PATCH Add sw64 architecture
+
+Add sw64 architecture in file bindings/swig/python/audit.py config.guess config.sub lib/libaudit.h src/libev/ev.c and tools/ausyscall/ausyscall.c to support sw64 architecture.
+
+Signed-off-by: wuzx <wuzx1226@qq.com>
+---
+ bindings/swig/python/audit.py | 1 +
+ config.guess                  | 8 ++++++++
+ config.sub                    | 1 +
+ lib/libaudit.h                | 1 +
+ src/libev/ev.c                | 3 +++
+ tools/ausyscall/ausyscall.c   | 6 ++++++
+ 6 files changed, 20 insertions(+)
+
+diff --git a/bindings/swig/python/audit.py b/bindings/swig/python/audit.py
+index 69631a7..14fa89b 100644
+--- a/bindings/swig/python/audit.py
++++ b/bindings/swig/python/audit.py
+@@ -607,6 +607,7 @@ MACH_PPC = _audit.MACH_PPC
+ MACH_S390X = _audit.MACH_S390X
+ MACH_S390 = _audit.MACH_S390
+ MACH_ALPHA = _audit.MACH_ALPHA
++MACH_SW_64 = _audit.MACH_SW_64
+ MACH_ARM = _audit.MACH_ARM
+ MACH_AARCH64 = _audit.MACH_AARCH64
+ MACH_PPC64LE = _audit.MACH_PPC64LE
+diff --git a/config.guess b/config.guess
+index b33c9e8..69e3005 100755
+--- a/config.guess
++++ b/config.guess
+@@ -913,6 +913,14 @@ EOF
+ 	UNAME_MACHINE=aarch64_be
+ 	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+ 	exit ;;
++    sw_64:Linux:*:*)
++	case `sed -n '/^cpu model/s/^.*: $.*$/\1/p' < /proc/cpuinfo` in
++	  sw)   UNAME_MACHINE=sw_64 ;;
++	esac
++	objdump --private-headers /bin/sh | grep -q ld.so.1
++	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
++	echo "$UNAME_MACHINE"-sunway-linux-"$LIBC"
++	exit ;;
+     alpha:Linux:*:*)
+ 	case `sed -n '/^cpu model/s/^.*: $.*$/\1/p' < /proc/cpuinfo` in
+ 	  EV5)   UNAME_MACHINE=alphaev5 ;;
+diff --git a/config.sub b/config.sub
+index b51fb8c..76babe9 100755
+--- a/config.sub
++++ b/config.sub
+@@ -1157,6 +1157,7 @@ case $cpu-$vendor in
+ 			| a29k \
+ 			| aarch64 | aarch64_be \
+ 			| abacus \
++			| sw_64 \
+ 			| alpha | alphaev4-8 | alphaev56 | alphaev678 \
+ 			| alpha64 | alpha64ev4-8 | alpha64ev56 | alpha64ev678 \
+ 			| alphapca567 | alpha64pca567 \
+diff --git a/lib/libaudit.h b/lib/libaudit.h
+index 3a8e8c8..16af222 100644
+--- a/lib/libaudit.h
++++ b/lib/libaudit.h
+@@ -561,6 +561,7 @@ typedef enum {
+ 	MACH_S390X,
+ 	MACH_S390,
+ 	MACH_ALPHA,	// Deprecated but has to stay
++	MACH_SW_64,	// Deprecated but has to stay
+ 	MACH_ARM,
+ 	MACH_AARCH64,
+ 	MACH_PPC64LE
+diff --git a/src/libev/ev.c b/src/libev/ev.c
+index 5ff936c..72765b5 100644
+--- a/src/libev/ev.c
++++ b/src/libev/ev.c
+@@ -828,6 +828,8 @@ struct signalfd_siginfo
+       #define ECB_MEMORY_FENCE         __asm__ __volatile__ (".set mips2; sync; .set mips0" : : : "memory")
+     #elif defined __alpha__
+       #define ECB_MEMORY_FENCE         __asm__ __volatile__ ("mb"       : : : "memory")
++    #elif defined __sw_64__
++      #define ECB_MEMORY_FENCE         __asm__ __volatile__ ("memb"       : : : "memory")
+     #elif defined __hppa__
+       #define ECB_MEMORY_FENCE         __asm__ __volatile__ (""         : : : "memory")
+       #define ECB_MEMORY_FENCE_RELEASE __asm__ __volatile__ ("")
+@@ -1550,6 +1552,7 @@ ecb_binary32_to_binary16 (uint32_t x)
+     || defined __s390__ || defined __s390x__ \
+     || defined __mips__ \
+     || defined __alpha__ \
++    || defined __sw_64__ \
+     || defined __hppa__ \
+     || defined __ia64__ \
+     || defined __m68k__ \
+diff --git a/tools/ausyscall/ausyscall.c b/tools/ausyscall/ausyscall.c
+index 4fb8f09..206e9ff 100644
+--- a/tools/ausyscall/ausyscall.c
++++ b/tools/ausyscall/ausyscall.c
+@@ -73,6 +73,12 @@ int main(int argc, char *argv)
+ 		} else if (strcmp("ia64", argvi) == 0) {
+ 			fputs("IA64 processor support is deprecated\n",
+ 					stderr);
++#ifndef WITH_SW_64
++		} else if (strcmp("sw_64", argvi) == 0) {
++			fputs("Sw_64 eabi processor support is not enabled\n",
++					stderr);
++			exit(1);
++#endif
+ #ifndef WITH_ARM
+ 		} else if (strcmp("arm", argvi) == 0) {
+ 			fputs("Arm eabi processor support is not enabled\n",
+-- 
+2.33.0
+

_service:tar_scm:backport-0001-In-auditd-close-the-logging-file-descriptor-when-log.patch Added

_service:tar_scm:backport-0002-In-auditd-close-the-logging-file-descriptor-when-log.patch Added

@@ -0,0 +1,59 @@
+From 770e4f538103f8a055f46c04a9e2514f88f175c3 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Mon, 1 Nov 2021 08:29:56 -0400
+Subject: PATCH 2244/2246 In auditd, close the logging file descriptor when
+ logging is suspended
+
+---
+ src/auditd-event.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/src/auditd-event.c b/src/auditd-event.c
+index 4a0a351..e88ef6e 100644
+--- a/src/auditd-event.c
++++ b/src/auditd-event.c
+@@ -861,6 +861,13 @@ static void do_space_left_action(int admin)
+ 		case FA_SUSPEND:
+ 			audit_msg(LOG_ALERT,
+ 			    "Audit daemon is suspending logging due to low disk space.");
++			// We need to close the file so that manual
++			// intervention can move or delete the file. We
++			// don't want to keep logging to a deleted file.
++			if (log_file)
++				fclose(log_file);
++			log_file = NULL;
++			log_fd = -1;
+ 			logging_suspended = 1;
+ 			break;
+ 		case FA_SINGLE:
+@@ -909,6 +916,13 @@ static void do_disk_full_action(void)
+ 		case FA_SUSPEND:
+ 			audit_msg(LOG_ALERT,
+ 			    "Audit daemon is suspending logging due to no space left on logging partition.");
++			// We need to close the file so that manual
++			// intervention can move or delete the file. We
++			// don't want to keep logging to a deleted file.
++			if (log_file)
++				fclose(log_file);
++			log_file = NULL;
++			log_fd = -1;
+ 			logging_suspended = 1;
+ 			break;
+ 		case FA_SINGLE:
+@@ -957,6 +971,13 @@ static void do_disk_error_action(const char *func, int err)
+ 		case FA_SUSPEND:
+ 			audit_msg(LOG_ALERT,
+ 			    "Audit daemon is suspending logging due to previously mentioned write error");
++			// We need to close the file so that manual
++			// intervention can move or delete the file. We
++			// don't want to keep logging to a deleted file.
++			if (log_file)
++				fclose(log_file);
++			log_file = NULL;
++			log_fd = -1;
+ 			logging_suspended = 1;
+ 			break;
+ 		case FA_SINGLE:
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Add-missing-call-to-free_interpretation_list.patch Added

_service:tar_scm:backport-Another-hardening-measure-for-corrupted-logs.patch Added

@@ -0,0 +1,85 @@
+From ab8f522953a56c860cac2cca2a7d7874419111d5 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Sat, 7 Aug 2021 13:13:19 -0400
+Subject: PATCH 2198/2246 Another hardening measure for corrupted logs
+
+---
+ src/ausearch-lookup.c |  3 +++
+ src/ausearch-parse.c  | 25 +++++++++++++++----------
+ 2 files changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/src/ausearch-lookup.c b/src/ausearch-lookup.c
+index e27c784..dd58c36 100644
+--- a/src/ausearch-lookup.c
++++ b/src/ausearch-lookup.c
+@@ -300,6 +300,9 @@ char *unescape(const char *buf)
+ 		while (isxdigit(*ptr))
+ 			ptr++;
+ 	}
++	if ((ptr - buf) == 0)
++		return NULL;
++
+ 	str = strndup(buf, ptr - buf);
+ 
+ 	if (*buf == '(')
+diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
+index d051137..78dc44c 100644
+--- a/src/ausearch-parse.c
++++ b/src/ausearch-parse.c
+@@ -1658,12 +1658,21 @@ static int parse_sockaddr(const lnode *n, search_items *s)
+ 	if (event_hostname || event_filename) {
+ 		str = strstr(n->message, "saddr=");
+ 		if (str) {
+-			int len;
++			unsigned int len = 0;
+ 			struct sockaddr *saddr;
+ 			char nameNI_MAXHOST;
+ 
+ 			str += 6;
+-			len = strlen(str)/2;
++			const char *ptr = str;
++			if (*ptr == '(') {
++				const char *ptr2 = strchr(ptr, ')');
++				if (ptr2)
++					len = (ptr2 - ptr) + 1;
++			} else {
++				while (isxdigit(ptrlen))
++					len++;
++				len /= 2;
++			}
+ 			s->hostname = unescape(str);
+ 			if (s->hostname == NULL)
+ 				return 4;
+@@ -1683,17 +1692,13 @@ static int parse_sockaddr(const lnode *n, search_items *s)
+ 				}
+ 				len = sizeof(struct sockaddr_in6);
+ 			} else if (saddr->sa_family == AF_UNIX) {
+-				struct sockaddr_un *un =
+-					(struct sockaddr_un *)saddr;
+-				if (un->sun_path0)
+-					len = strlen(un->sun_path);
+-				else // abstract name
+-					len = strlen(&un->sun_path1);
+-				if (len == 0) {
++				if (len < 4) {
+ 					fprintf(stderr,
+ 						"sun_path len too short\n");
+ 					return 3;
+ 				}
++				struct sockaddr_un *un =
++					(struct sockaddr_un *)saddr;
+ 				if (event_filename) {
+ 					if (!s->filename) {
+ 						//create
+@@ -1736,7 +1741,7 @@ static int parse_sockaddr(const lnode *n, search_items *s)
+ 				s->hostname = NULL;
+ 				return 0;
+ 			}
+-			if (getnameinfo(saddr, len, name, NI_MAXHOST, 
++			if (getnameinfo(saddr, len, name, NI_MAXHOST,
+ 					NULL, 0, NI_NUMERICHOST) ) {
+ 				free(s->hostname);
+ 				s->hostname = NULL;
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Better-fix-for-busy-loop-in-normalizer-when-logs-are.patch Added

_service:tar_scm:backport-Check-ctime-return-code.patch Added

@@ -0,0 +1,47 @@
+From fd76e380ea117000d9d350405e2cfbd070c5c01a Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Sat, 21 Aug 2021 10:18:30 -0400
+Subject: PATCH 2213/2246 Check ctime return code
+
+---
+ tools/aulast/aulast.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/tools/aulast/aulast.c b/tools/aulast/aulast.c
+index c513aac..8a25f3b 100644
+--- a/tools/aulast/aulast.c
++++ b/tools/aulast/aulast.c
+@@ -96,8 +96,11 @@ static void report_session(lnode* cur)
+ 			int mins, hours, days;
+ 			if (notime)
+ 				printf("- %-7.5s", " ");
+-			else
+-				printf("- %-7.5s", ctime(&cur->end) + 11);
++			else {
++				char *ttime = ctime(&cur->end);
++				printf("- %-7.5s", ttime ? ttime + 11 :
++				       "bad value");
++			}
+ 			secs = cur->end - cur->start;
+ 			mins  = (secs / 60) % 60;
+ 			hours = (secs / 3600) % 24;
+@@ -128,10 +131,13 @@ static void report_session(lnode* cur)
+ 		strftime(start, sizeof(start), "%x %T", btm);
+ 		if (cur->end != 0) {
+ 			btm = localtime(&cur->end);
+-			strftime(end, sizeof(end), "%x %T", btm);
+-		      printf("    ausearch --start %s --end %s",
+-				start, end);
++			if (btm) {
++				strftime(end, sizeof(end), "%x %T", btm);
++				printf("    ausearch --start %s --end %s",
++					start, end);
++			} else goto no_end;
+ 		} else {
++no_end:
+ 		    printf("    ausearch --start %s", start);
+ 		}
+ 		if (cur->name == NULL)
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Check-for-fuzzer-induced-invalid-value.patch Added

_service:tar_scm:backport-Dont-run-off-the-end-with-corrupt-logs.patch Added

@@ -0,0 +1,43 @@
+From 50c65ae25e64b7bd4489ce22a4c7789fa9a81f2f Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Sat, 7 Aug 2021 11:33:20 -0400
+Subject: PATCH 2197/2246 Dont run off the end with corrupt logs
+
+---
+ src/ausearch-parse.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
+index 81ef319..d051137 100644
+--- a/src/ausearch-parse.c
++++ b/src/ausearch-parse.c
+@@ -1031,7 +1031,7 @@ static int parse_user(const lnode *n, search_items *s, anode *avc)
+ 		if (str) {
+ 			str += 5;
+ 			term = str;
+-			while (*term != ' ' && *term != ':')
++			while (*term != ' ' && *term != ':' && *term)
+ 				term++;
+ 			if (term == str)
+ 				return 24;
+@@ -1244,7 +1244,7 @@ skip:
+ 				char *end = str;
+ 				int legacy = 0;
+ 
+-				while (*end != ' ') {
++				while (*end != ' ' && *end) {
+ 					if (!isxdigit(*end)) {
+ 						legacy = 1;
+ 					}
+@@ -1295,7 +1295,7 @@ skip:
+ 				char *end = str;
+ 				int legacy = 0;
+ 
+-				while (*end != ' ') {
++				while (*end != ' ' && *end) {
+ 					if (!isxdigit(*end)) {
+ 						legacy = 1;
+ 					}
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-an-auparse-memory-leak-caused-in-recent-glibc.patch Added

@@ -0,0 +1,35 @@
+From 16246878c503d7395ae668817bf629e05361fec5 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Thu, 29 Jul 2021 18:39:22 -0400
+Subject: PATCH Fix an auparse memory leak caused in recent glibc
+
+---
+ auparse/interpret.c | 4 ++++-
+ 1 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/auparse/interpret.c b/auparse/interpret.c
+index 2813acb..33c173e 100644
+--- a/auparse/interpret.c
++++ b/auparse/interpret.c
+@@ -50,6 +50,7 @@
+ #include <sys/personality.h>
+ #include <sys/prctl.h>
+ #include <sched.h>
++#include <limits.h>     /* PATH_MAX */
+ #ifdef USE_FANOTIFY
+ #include <linux/fanotify.h>
+ #else
+@@ -865,8 +866,10 @@ static const char *print_escaped_ext(const idata *id)
+ 			str1 = NULL;
+ 		}
+ 		errno = 0;
+-		out = realpath(str3, NULL);
++		out = malloc(PATH_MAX);
++		realpath(str3, out);
+ 		if (errno) { // If there's an error, just return the original
++			free(out);
+ 			free(str1);
+ 			free(str2);
+ 			return str3;
+-- 
+

_service:tar_scm:backport-Fix-busy-loop-in-normalizer-when-logs-are-corrupt.patch Added

_service:tar_scm:backport-Fix-double-free-with-corrupted-logs.patch Added

_service:tar_scm:backport-Fix-some-string-length-issues.patch Added

@@ -0,0 +1,64 @@
+From 39f868fef95f95786358bc3690a327d4f11d2d43 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Thu, 3 Jun 2021 16:18:36 -0400
+Subject: PATCH 2084/2246 Fix some string length issues
+
+In interpret, fix the size so that we need to size it again later if new
+strings get added. The ausearch/report issues have the size information
+available, so FORTIFY_SOURCE should keep things in check.
+---
+ auparse/interpret.c | 2 +-
+ src/aureport.c      | 4 ++--
+ src/ausearch.c      | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/auparse/interpret.c b/auparse/interpret.c
+index e22cae7..5d6f31a 100644
+--- a/auparse/interpret.c
++++ b/auparse/interpret.c
+@@ -1242,7 +1242,7 @@ static const char *print_flags(const char *val)
+ {
+         int flags, cnt = 0;
+ 	size_t i;
+-	char *out, buf80;
++	char *out, bufsizeof(flag_strings);
+ 
+         errno = 0;
+         flags = strtoul(val, NULL, 16);
+diff --git a/src/aureport.c b/src/aureport.c
+index d0251a4..22618f0 100644
+--- a/src/aureport.c
++++ b/src/aureport.c
+@@ -168,10 +168,10 @@ static int process_logs(void)
+ 	int num = 0;
+ 
+ 	if (user_file && userfile_is_dir) {
+-		char dirnameMAXPATHLEN;
++		char dirnameMAXPATHLEN+1;
+ 		clear_config (&config);
+ 
+-		strcpy(dirname, user_file);
++		strncpy(dirname, user_file, MAXPATHLEN-32);
+ 		if (dirnamestrlen(dirname)-1 != '/')
+ 			strcat(dirname, "/");
+ 		strcat (dirname, "audit.log");
+diff --git a/src/ausearch.c b/src/ausearch.c
+index 97f89bf..768807e 100644
+--- a/src/ausearch.c
++++ b/src/ausearch.c
+@@ -228,10 +228,10 @@ static int process_logs(void)
+ 	int ret;
+ 
+ 	if (user_file && userfile_is_dir) {
+-		char dirnameMAXPATHLEN;
++		char dirnameMAXPATHLEN+1;
+ 		clear_config (&config);
+ 
+-		strcpy(dirname, user_file);
++		strncpy(dirname, user_file, MAXPATHLEN-32);
+ 		if (dirnamestrlen(dirname)-1 != '/')
+ 				strcat(dirname, "/");
+ 		strcat (dirname, "audit.log");
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-the-closing-timing-of-audit_fd-166.patch Added

_service:tar_scm:backport-Fix-the-default-location-for-zos-remote.conf-171.patch Added

@@ -0,0 +1,37 @@
+From ea21005f1abba62ed4acd7432c6e721504909511 Mon Sep 17 00:00:00 2001
+From: Pythoner <yixiangzhike007@163.com>
+Date: Mon, 19 Apr 2021 14:10:14 -0500
+Subject: PATCH 2052/2052 Fix the default location for zos-remote.conf (#171)
+
+---
+ audisp/plugins/zos-remote/audispd-zos-remote.conf | 2 +-
+ docs/zos-remote.conf.5                            | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/audisp/plugins/zos-remote/audispd-zos-remote.conf b/audisp/plugins/zos-remote/audispd-zos-remote.conf
+index 13aef2c..eda199e 100644
+--- a/audisp/plugins/zos-remote/audispd-zos-remote.conf
++++ b/audisp/plugins/zos-remote/audispd-zos-remote.conf
+@@ -10,5 +10,5 @@ active = no
+ direction = out
+ path = /sbin/audispd-zos-remote
+ type = always 
+-args = /etc/audisp/zos-remote.conf
++args = /etc/audit/zos-remote.conf
+ format = string
+diff --git a/docs/zos-remote.conf.5 b/docs/zos-remote.conf.5
+index 4bf504d..7ee92e3 100644
+--- a/docs/zos-remote.conf.5
++++ b/docs/zos-remote.conf.5
+@@ -26,7 +26,7 @@ zos\-remote.conf \- the audisp-racf plugin configuration file
+ controls the configuration for the
+ .BR audispd\-zos\-remote (8)
+ Audit dispatcher plugin. The default location for this file is
+-.IR /etc/audisp/zos\-remote.conf ,
++.IR /etc/audit/zos\-remote.conf ,
+ however, a different file can be specified as the first argument to the
+ .B audispd\-zos\-remote
+ plugin. See
+-- 
+1.8.3.1
+

_service:tar_scm:backport-In-auditd-check-if-log_file-is-valid-before-closing-.patch Added

@@ -0,0 +1,135 @@
+From 6531c7dfb832ea245d8004662ea7c4e90107c0df Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Wed, 11 Aug 2021 15:10:18 -0400
+Subject: PATCH 2207/2246 In auditd, check if log_file is valid before
+ closing handle
+
+---
+ src/auditd-event.c | 44 +++++++++++++++++++++++++++++++----------------
+ 1 files changed, 29 insertions(+), 15 deletions(-)
+
+diff --git a/src/auditd-event.c b/src/auditd-event.c
+index 3655726..788c44a 100644
+--- a/src/auditd-event.c
++++ b/src/auditd-event.c
+@@ -71,7 +71,7 @@ static void init_flush_thread(void);
+ /* Local Data */
+ static struct daemon_conf *config;
+ static volatile int log_fd;
+-static FILE *log_file;
++static FILE *log_file = NULL;
+ static unsigned int disk_err_warning = 0;
+ static int fs_space_warning = 0;
+ static int fs_admin_space_warning = 0;
+@@ -174,7 +175,8 @@ int init_event(struct daemon_conf *conf)
+ 	format_buf = (char *)malloc(FORMAT_BUF_LEN);
+ 	if (format_buf == NULL) {
+ 		audit_msg(LOG_ERR, "No memory for formatting, exiting");
+-		fclose(log_file);
++		if (log_file)
++			fclose(log_file);
+ 		log_file = NULL;
+ 		return 1;
+ 	}
+@@ -212,7 +214,8 @@ static void *flush_thread_main(void *arg)
+ 		flush = 0;
+ 		pthread_mutex_unlock(&flush_lock);
+ 
+-		fsync(log_fd);
++		if (log_fd >= 0)
++			fsync(log_fd);
+ 	}
+ 	return NULL;
+ }
+@@ -589,7 +592,8 @@ void handle_event(struct auditd_event *e)
+ 				if (config->daemonize == D_BACKGROUND) {
+ 					if (config->flush == FT_INCREMENTAL) {
+ 						/* EIO is only likely failure */
+-						if (fsync(log_fd) != 0) {
++						if (log_fd >= 0 &&
++							fsync(log_fd) != 0) {
+ 						     do_disk_error_action(
+ 							"fsync",
+ 							errno);
+@@ -744,6 +748,9 @@ static void check_space_left(void)
+ 	int rc;
+ 	struct statfs buf;
+ 
++	if (log_fd < 0)
++		return;
++
+         rc = fstatfs(log_fd, &buf);
+         if (rc == 0) {
+ 		if (buf.f_bavail < 5) {
+@@ -831,7 +838,8 @@ static void do_space_left_action(int admin)
+ 		case FA_EXEC:
+ 			// Close the logging file in case the script zips or
+ 			// moves the file. We'll reopen in sigusr2 handler
+-			fclose(log_file);
++			if (log_file)
++				fclose(log_file);
+ 			log_file = NULL;
+ 			log_fd = -1;
+ 			logging_suspended = 1;
+@@ -881,7 +889,8 @@ static void do_disk_full_action(void)
+ 		case FA_EXEC:
+ 			// Close the logging file in case the script zips or
+ 			// moves the file. We'll reopen in sigusr2 handler
+-			fclose(log_file);
++			if (log_file)
++				fclose(log_file);
+ 			log_file = NULL;
+ 			log_fd = -1;
+ 			logging_suspended = 1;
+@@ -928,7 +937,8 @@ static void do_disk_error_action(const char *func, int err)
+ 		case FA_EXEC:
+ 			// Close the logging file in case the script zips or
+ 			// moves the file. We'll reopen in sigusr2 handler
+-			fclose(log_file);
++			if (log_file)
++				fclose(log_file);
+ 			log_file = NULL;
+ 			log_fd = -1;
+ 			logging_suspended = 1;
+@@ -1053,17 +1063,21 @@ static void rotate_logs(unsigned int num_logs, unsigned int keep_logs)
+ 	/* Close audit file. fchmod and fchown errors are not fatal because we
+ 	 * already adjusted log file permissions and ownership when opening the
+ 	 * log file. */
+-	if (fchmod(log_fd, config->log_group ? S_IRUSR|S_IRGRP : S_IRUSR) < 0){
+-		audit_msg(LOG_WARNING, "Couldn't change permissions while "
++	if (log_fd >= 0) {
++		if (fchmod(log_fd, config->log_group ? S_IRUSR|S_IRGRP :
++			  S_IRUSR) < 0){
++		    audit_msg(LOG_WARNING, "Couldn't change permissions while "
+ 			"rotating log file (%s)", strerror(errno));
+-	}
+-	if (fchown(log_fd, 0, config->log_group) < 0) {
+-		audit_msg(LOG_WARNING, "Couldn't change ownership while "
++		}
++		if (fchown(log_fd, 0, config->log_group) < 0) {
++		    audit_msg(LOG_WARNING, "Couldn't change ownership while "
+ 			"rotating log file (%s)", strerror(errno));
++		}
+ 	}
+-	fclose(log_file);
++	if (log_file)
++		fclose(log_file);
+ 	log_file = NULL;
+-	
++
+ 	/* Rotate */
+ 	len = strlen(config->log_file) + 16;
+ 	oldname = (char *)malloc(len);
+@@ -1470,7 +1484,8 @@ static void reconfigure(struct auditd_event *e)
+ 		free((void *)nconf->log_file);
+ 
+ 	if (need_reopen) {
+-		fclose(log_file);
++		if (log_file)
++			fclose(log_file);
+ 		log_file = NULL;
+ 		fix_disk_permissions();
+ 		if (open_audit_log()) {
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Move-the-free_config-to-success-path.patch Added

_service:tar_scm:backport-When-interpreting-if-val-is-NULL-return-an-empty-str.patch Added

_service:tar_scm:backport-auditd.service-Restart-on-failure-ignoring-some-exit.patch Added

@@ -0,0 +1,35 @@
+From 30382bfcc0f64f451bc084c9657a546cb34492a7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= <travier@redhat.com>
+Date: Fri, 1 Oct 2021 16:35:57 +0200
+Subject: PATCH 2228/2246 auditd.service: Restart 'on-failure', ignoring some
+ exit codes (#217)
+
+Use `Restart=on-failure` to automatically restart `auditd`. Do not
+restart for intentional exits. See EXIT CODES section in auditd(8).
+
+See:
+- https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=
+- https://www.freedesktop.org/software/systemd/man/systemd.service.html#RestartPreventExitStatus=
+
+Fixes: https://github.com/linux-audit/audit-userspace/issues/211
+---
+ init.d/auditd.service | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/init.d/auditd.service b/init.d/auditd.service
+index 67cda58..e801281 100644
+--- a/init.d/auditd.service
++++ b/init.d/auditd.service
+@@ -27,6 +27,9 @@ ExecStartPost=-/sbin/augenrules --load
+ # By default we don't clear the rules on exit. To enable this, uncomment
+ # the next line after copying the file to /etc/systemd/system/auditd.service
+ #ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
++Restart=on-failure
++# Do not restart for intentional exits. See EXIT CODES section in auditd(8).
++RestartPreventExitStatus=2 4 6
+ 
+ ### Security Settings ###
+ MemoryDenyWriteExecute=true
+-- 
+1.8.3.1
+

_service:tar_scm:backport-error-out-if-log-is-mangled.patch Added

_service:tar_scm:backport-fix-2-more-issues-found-by-fuzzing.patch Added

@@ -0,0 +1,46 @@
+From f4683d04eadb7d76b98497af834f027d6005d893 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Mon, 9 Aug 2021 17:14:17 -0400
+Subject: PATCH fix 2 more issues found by fuzzing
+
+---
+ auparse/auparse.c | 8 +++++++-
+ auparse/ellist.c  | 4 +++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/auparse/auparse.c b/auparse/auparse.c
+index b0e685a..3cf512a 100644
+--- a/auparse/auparse.c
++++ b/auparse/auparse.c
+@@ -1611,7 +1611,13 @@ static int au_auparse_next_event(auparse_state_t *au)
+ 		}
+ 		aup_list_create(l);
+ 		aup_list_set_event(l, &e);
+-		aup_list_append(l, au->cur_buf, au->list_idx, au->line_number);
++		if (aup_list_append(l, au->cur_buf, au->list_idx,
++				    au->line_number) < 0) {
++			au->cur_buf = NULL;
++			aup_list_clear(l);
++			free(l);
++			continue;
++		}
+ 		// Eat standalone EOE - main event was already marked complete
+ 		if (l->head->type == AUDIT_EOE) {
+ 			au->cur_buf = NULL;
+diff --git a/auparse/ellist.c b/auparse/ellist.c
+index 7d9c552..dd711bc 100644
+--- a/auparse/ellist.c
++++ b/auparse/ellist.c
+@@ -290,7 +290,9 @@ static int parse_up_record(rnode* r)
+ 					while (ptr && *ptr != '}') {
+ 						len = strlen(ptr);
+ 						if ((len+1) >= (256-total)) {
+-							free(buf);
++						   if (nvlist_get_cnt(&r->nv)
++									 == 0)
++								free(buf);
+ 							return -1;
+ 						}
+ 						if (tmpctx0) {
+-- 
+

_service:tar_scm:backport-flush-uid-gid-caches-when-user-group-added-deleted-m.patch Added

@@ -0,0 +1,128 @@
+From 8662f61108f8b9365f96ef49ca8ca331a7880f24 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Tue, 10 Aug 2021 11:27:16 -0400
+Subject: PATCH 2205/2246 flush uid/gid caches when user/group
+ added/deleted/modified
+
+It was reported in issue #209 that in the enriched format that auditd
+is creating the wrong account associations. This is due to caching
+previous lookups. The fix is to monitor for account lifecycle changes
+and flush the LRUs if any are seen.
+---
+ auparse/auparse-idata.h |  3 ++-
+ auparse/interpret.c     | 12 ++++++++++++
+ src/auditd-event.c      | 27 +++++++++++++++++++++++++--
+ 3 files changed, 39 insertions(+), 3 deletions(-)
+
+diff --git a/auparse/auparse-idata.h b/auparse/auparse-idata.h
+index 660901a..eaca86a 100644
+--- a/auparse/auparse-idata.h
++++ b/auparse/auparse-idata.h
+@@ -1,6 +1,6 @@
+ /*
+ * idata.h - Header file for ausearch-lookup.c
+-* Copyright (c) 2013,2016-17 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2013,2016-17,2021 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+@@ -45,6 +45,7 @@ char *auparse_do_interpretation(int type, const idata *id,
+ void _auparse_load_interpretations(const char *buf);
+ void _auparse_free_interpretations(void);
+ const char *_auparse_lookup_interpretation(const char *name);
++void _auparse_flush_caches(void);
+ 
+ #endif
+ 
+diff --git a/auparse/interpret.c b/auparse/interpret.c
+index 046867b..eef377a 100644
+--- a/auparse/interpret.c
++++ b/auparse/interpret.c
+@@ -653,6 +653,18 @@ void aulookup_destroy_gid_list(void)
+ 	gid_cache_created = 0;
+ }
+ 
++void _auparse_flush_caches(void)
++{
++	if (uid_cache_created) {
++		destroy_lru(uid_cache);
++		uid_cache_created = 0;
++	}
++	if (gid_cache_created) {
++		destroy_lru(gid_cache);
++		gid_cache_created = 0;
++	}
++}
++
+ static const char *print_uid(const char *val, unsigned int base)
+ {
+         int uid;
+diff --git a/src/auditd-event.c b/src/auditd-event.c
+index cb29fee..3655726 100644
+--- a/src/auditd-event.c
++++ b/src/auditd-event.c
+@@ -42,6 +42,7 @@
+ #include "libaudit.h"
+ #include "private.h"
+ #include "auparse.h"
++#include "auparse-idata.h"
+ 
+ /* This is defined in auditd.c */
+ extern volatile int stop;
+@@ -56,7 +57,7 @@ static void do_space_left_action(int admin);
+ static void do_disk_full_action(void);
+ static void do_disk_error_action(const char *func, int err);
+ static void fix_disk_permissions(void);
+-static void check_excess_logs(void); 
++static void check_excess_logs(void);
+ static void rotate_logs_now(void);
+ static void rotate_logs(unsigned int num_logs, unsigned int keep_logs);
+ static void shift_logs(void);
+@@ -394,7 +395,7 @@ static const char *format_enrich(const struct audit_reply *rep)
+ 	        	snprintf(format_buf, MAX_AUDIT_MESSAGE_LENGTH,
+ 		    "type=DAEMON_ERR op=format-enriched msg=NULL res=failed");
+ 	} else {
+-		int rc;
++		int rc, rtype;
+ 		size_t mlen, len;
+ 		char *message;
+ 		// Do raw format to get event started
+@@ -427,6 +428,17 @@ static const char *format_enrich(const struct audit_reply *rep)
+ 
+ 		// Loop over all fields while possible to add field
+ 		rc = auparse_first_record(au);
++		rtype = auparse_get_type(au);
++		switch (rtype)
++		{	// Flush before adding to pickup new associations
++			case AUDIT_ADD_USER:
++			case AUDIT_ADD_GROUP:
++				_auparse_flush_caches();
++				break;
++			default:
++				break;
++		}
++
+ 		while (rc > 0 && len > MIN_SPACE_LEFT) {
+ 			// See what kind of field we have
+ 			size_t vlen;
+@@ -454,6 +466,17 @@ static const char *format_enrich(const struct audit_reply *rep)
+ 			rc = auparse_next_field(au);
+ 		}
+ 
++		switch(rtype)
++		{	// Flush after modification to remove stale entries
++			case AUDIT_USER_MGMT:
++			case AUDIT_DEL_USER:
++			case AUDIT_DEL_GROUP:
++			case AUDIT_GRP_MGMT:
++				_auparse_flush_caches();
++				break;
++			default:
++				break;
++		}
+ 		free(message);
+ 	}
+         return format_buf;
+-- 
+1.8.3.1
+

_service:tar_scm:bugfix-audit-reload-coredump.patch Added

@@ -0,0 +1,99 @@
+From 2a7404291e431757bc417c9c3250f2ca84a82d89 Mon Sep 17 00:00:00 2001
+From: Leo Fang <leofang_94@163.com>
+Date: Mon, 24 May 2021 19:16:02 +0800
+Subject: PATCH bugfix-audit-reload-coredump
+
+---
+ src/auditd-reconfig.c |  2 ++
+ src/auditd.c          | 36 +++++++++++++++++++++++++++++-------
+ 2 files changed, 31 insertions(+), 7 deletions(-)
+
+diff --git a/src/auditd-reconfig.c b/src/auditd-reconfig.c
+index f5b00e6..5ea9126 100644
+--- a/src/auditd-reconfig.c
++++ b/src/auditd-reconfig.c
+@@ -35,6 +35,7 @@
+ 
+ /* externs we need to know about */
+ extern void reconfig_ready(void);
++extern void reconfig_pthread_failed(void);
+ 
+ /* This is the configuration manager code */
+ static pthread_t config_thread;
+@@ -122,6 +123,7 @@ static void *config_thread_main(void *arg)
+ 		//send_audit_event(AUDIT_DAEMON_CONFIG, txt);
+ 		free_config(&new_config);
+ 		free(e);
++		reconfig_pthread_failed();
+ 	}
+ 
+ 	pthread_mutex_unlock(&config_lock);
+diff --git a/src/auditd.c b/src/auditd.c
+index fa783a2..0d76e0c 100644
+--- a/src/auditd.c
++++ b/src/auditd.c
+@@ -76,6 +76,7 @@ static int hup_info_requested = 0;
+ static int usr1_info_requested = 0, usr2_info_requested = 0;
+ static char subjSUBJ_LEN;
+ static uint32_t session;
++static int hup_flag = 0;
+ 
+ /* Local function prototypes */
+ int send_audit_event(int type, const char *str);
+@@ -519,15 +520,30 @@ static void netlink_handler(struct ev_loop *loop, struct ev_io *io,
+ 				char hupMAX_AUDIT_MESSAGE_LENGTH;
+ 				audit_msg(LOG_DEBUG,
+ 				    "HUP detected, starting config manager");
+-				reconfig_ev = cur_event;
+-				if (start_config_manager(cur_event)) {
++				if(hup_flag == 0)
++				{
++					hup_flag = 1;
++					reconfig_ev = cur_event;
++					if (start_config_manager(cur_event)) {
++						audit_format_signal_info(hup,
++								 	sizeof(hup),
++						 	"reconfigure state=no-change",
++							 	&cur_event->reply,
++								 	"failed");
++						send_audit_event(AUDIT_DAEMON_CONFIG,
++							 	hup);
++						hup_flag = 0;
++					}
++				}
++				else
++				{
+ 					audit_format_signal_info(hup,
+-								 sizeof(hup),
+-						 "reconfigure state=no-change",
+-							 &cur_event->reply,
+-								 "failed");
++							 	sizeof(hup),
++					 	"reconfigure state=no-change",
++						 	&cur_event->reply,
++							 	"failed");
+ 					send_audit_event(AUDIT_DAEMON_CONFIG,
+-							 hup);
++						 	hup);
+ 				}
+ 				cur_event = NULL;
+ 				hup_info_requested = 0;
+@@ -571,9 +587,15 @@ static void pipe_handler(struct ev_loop *loop, struct ev_io *io,
+ 	// Drain the pipe - won't block because libev sets non-blocking mode
+ 	read(pipefds0, buf, sizeof(buf));
+ 	enqueue_event(reconfig_ev);
++	hup_flag = 0;
+ 	reconfig_ev = NULL;
+ }
+ 
++void reconfig_pthread_failed(void)
++{
++	hup_flag = 0;
++}
++
+ void reconfig_ready(void)
+ {
+ 	const char *msg = "ready\n";
+-- 
+1.8.3.1
+

_service:tar_scm:bugfix-audit-support-armv7b.patch Added

_service:tar_scm:bugfix-audit-userspace-missing-syscalls-for-aarm64.patch Added

@@ -0,0 +1,67 @@
+From ad68debcab63df34dc7b1fc4b4fd4fc4f01b8d7c Mon Sep 17 00:00:00 2001
+From: jinbo <jinbo8@huawei.com>
+Date: Mon, 12 Nov 2018 21:54:29 +0800
+Subject: PATCH audit: userspace missing syscalls for aarm64
+
+API_change: n
+reason: reconsitution userspace audit missing syscalls for aarm64
+
+Signed-off-by: jinbo <jinbo8@huawei.com>
+---
+ lib/aarch64_table.h | 43 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+diff --git a/lib/aarch64_table.h b/lib/aarch64_table.h
+index c61aa91..ea634c1 100644
+--- a/lib/aarch64_table.h
++++ b/lib/aarch64_table.h
+@@ -311,3 +311,46 @@ _S(438, "pidfd_getfd")
+ _S(439, "faccessat2")
+ _S(440, "process_madvise")
+ _S(441, "epoll_pwait2")
++_S(1024, "open")
++_S(1025, "link")
++_S(1026, "unlink")
++_S(1027, "mknod")
++_S(1028, "chmod")
++_S(1029, "chown")
++_S(1030, "mkdir")
++_S(1031, "rmdir")
++_S(1032, "lchown")
++_S(1033, "access")
++_S(1034, "rename")
++_S(1035, "readlink")
++_S(1036, "symlink")
++_S(1037, "utimes")
++_S(1038, "stat64")
++_S(1039, "lstat64")
++_S(1040, "pipe")
++_S(1041, "dup2")
++_S(1042, "epoll_create")
++_S(1043, "inotify_init")
++_S(1044, "eventfd")
++_S(1045, "signalfd")
++_S(1049, "newstat")
++_S(1050, "newlstat")
++_S(1059, "alarm")
++_S(1060, "getpgrp")
++_S(1061, "pause")
++_S(1062, "time")
++_S(1063, "utime")
++_S(1064, "creat")
++_S(1066, "futimesat")
++_S(1067, "select")
++_S(1068, "poll")
++_S(1069, "epoll_wait")
++_S(1070, "ustat")
++_S(1071, "vfork")
++_S(1073, "recv")
++_S(1074, "send")
++_S(1075, "bdflush")
++_S(1076, "oldumount")
++_S(1077, "uselib")
++_S(1078, "sysctl")
++_S(1079, "fork")
+-- 
+1.8.5.6
+

_service Changed

_service:extract_file:audit-3.0.1.tar.gz Deleted

_service:extract_file:audit.yaml Deleted

_service:extract_file:lgpl-2.1.txt Deleted

@@ -1,502 +0,0 @@
-                  GNU LESSER GENERAL PUBLIC LICENSE
-                       Version 2.1, February 1999
-
- Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-This is the first released version of the Lesser GPL.  It also counts
- as the successor of the GNU Library Public License, version 2, hence
- the version number 2.1.
-
-                            Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-Licenses are intended to guarantee your freedom to share and change
-free software--to make sure the software is free for all its users.
-
-  This license, the Lesser General Public License, applies to some
-specially designated software packages--typically libraries--of the
-Free Software Foundation and other authors who decide to use it.  You
-can use it too, but we suggest you first think carefully about whether
-this license or the ordinary General Public License is the better
-strategy to use in any particular case, based on the explanations below.
-
-  When we speak of free software, we are referring to freedom of use,
-not price.  Our General Public Licenses are designed to make sure that
-you have the freedom to distribute copies of free software (and charge
-for this service if you wish); that you receive source code or can get
-it if you want it; that you can change the software and use pieces of
-it in new free programs; and that you are informed that you can do
-these things.
-
-  To protect your rights, we need to make restrictions that forbid
-distributors to deny you these rights or to ask you to surrender these
-rights.  These restrictions translate to certain responsibilities for
-you if you distribute copies of the library or if you modify it.
-
-  For example, if you distribute copies of the library, whether gratis
-or for a fee, you must give the recipients all the rights that we gave
-you.  You must make sure that they, too, receive or can get the source
-code.  If you link other code with the library, you must provide
-complete object files to the recipients, so that they can relink them
-with the library after making changes to the library and recompiling
-it.  And you must show them these terms so they know their rights.
-
-  We protect your rights with a two-step method: (1) we copyright the
-library, and (2) we offer you this license, which gives you legal
-permission to copy, distribute and/or modify the library.
-
-  To protect each distributor, we want to make it very clear that
-there is no warranty for the free library.  Also, if the library is
-modified by someone else and passed on, the recipients should know
-that what they have is not the original version, so that the original
-author's reputation will not be affected by problems that might be
-introduced by others.
-&#xc;
-  Finally, software patents pose a constant threat to the existence of
-any free program.  We wish to make sure that a company cannot
-effectively restrict the users of a free program by obtaining a
-restrictive license from a patent holder.  Therefore, we insist that
-any patent license obtained for a version of the library must be
-consistent with the full freedom of use specified in this license.
-
-  Most GNU software, including some libraries, is covered by the
-ordinary GNU General Public License.  This license, the GNU Lesser
-General Public License, applies to certain designated libraries, and
-is quite different from the ordinary General Public License.  We use
-this license for certain libraries in order to permit linking those
-libraries into non-free programs.
-
-  When a program is linked with a library, whether statically or using
-a shared library, the combination of the two is legally speaking a
-combined work, a derivative of the original library.  The ordinary
-General Public License therefore permits such linking only if the
-entire combination fits its criteria of freedom.  The Lesser General
-Public License permits more lax criteria for linking other code with
-the library.
-
-  We call this license the "Lesser" General Public License because it
-does Less to protect the user's freedom than the ordinary General
-Public License.  It also provides other free software developers Less
-of an advantage over competing non-free programs.  These disadvantages
-are the reason we use the ordinary General Public License for many
-libraries.  However, the Lesser license provides advantages in certain
-special circumstances.
-
-  For example, on rare occasions, there may be a special need to
-encourage the widest possible use of a certain library, so that it becomes
-a de-facto standard.  To achieve this, non-free programs must be
-allowed to use the library.  A more frequent case is that a free
-library does the same job as widely used non-free libraries.  In this
-case, there is little to gain by limiting the free library to free
-software only, so we use the Lesser General Public License.
-
-  In other cases, permission to use a particular library in non-free
-programs enables a greater number of people to use a large body of
-free software.  For example, permission to use the GNU C Library in
-non-free programs enables many more people to use the whole GNU
-operating system, as well as its variant, the GNU/Linux operating
-system.
-
-  Although the Lesser General Public License is Less protective of the
-users' freedom, it does ensure that the user of a program that is
-linked with the Library has the freedom and the wherewithal to run
-that program using a modified version of the Library.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.  Pay close attention to the difference between a
-"work based on the library" and a "work that uses the library".  The
-former contains code derived from the library, whereas the latter must
-be combined with the library in order to run.
-&#xc;
-                  GNU LESSER GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License Agreement applies to any software library or other
-program which contains a notice placed by the copyright holder or
-other authorized party saying it may be distributed under the terms of
-this Lesser General Public License (also called "this License").
-Each licensee is addressed as "you".
-
-  A "library" means a collection of software functions and/or data
-prepared so as to be conveniently linked with application programs
-(which use some of those functions and data) to form executables.
-
-  The "Library", below, refers to any such software library or work
-which has been distributed under these terms.  A "work based on the
-Library" means either the Library or any derivative work under
-copyright law: that is to say, a work containing the Library or a
-portion of it, either verbatim or with modifications and/or translated
-straightforwardly into another language.  (Hereinafter, translation is
-included without limitation in the term "modification".)
-
-  "Source code" for a work means the preferred form of the work for
-making modifications to it.  For a library, complete source code means
-all the source code for all modules it contains, plus any associated
-interface definition files, plus the scripts used to control compilation
-and installation of the library.
-
-  Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running a program using the Library is not restricted, and output from
-such a program is covered only if its contents constitute a work based
-on the Library (independent of the use of the Library in a tool for
-writing it).  Whether that is true depends on what the Library does
-and what the program that uses the Library does.
-
-  1. You may copy and distribute verbatim copies of the Library's
-complete source code as you receive it, in any medium, provided that
-you conspicuously and appropriately publish on each copy an
-appropriate copyright notice and disclaimer of warranty; keep intact
-all the notices that refer to this License and to the absence of any
-warranty; and distribute a copy of this License along with the
-Library.
-
-  You may charge a fee for the physical act of transferring a copy,
-and you may at your option offer warranty protection in exchange for a
-fee.
-&#xc;
-  2. You may modify your copy or copies of the Library or any portion
-of it, thus forming a work based on the Library, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) The modified work must itself be a software library.
-
-    b) You must cause the files modified to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    c) You must cause the whole of the work to be licensed at no
-    charge to all third parties under the terms of this License.
-
-    d) If a facility in the modified Library refers to a function or a
-    table of data to be supplied by an application program that uses
-    the facility, other than as an argument passed when the facility
-    is invoked, then you must make a good faith effort to ensure that,
-    in the event an application does not supply such function or
-    table, the facility still operates, and performs whatever part of
-    its purpose remains meaningful.
-
-    (For example, a function in a library to compute square roots has
-    a purpose that is entirely well-defined independent of the
-    application.  Therefore, Subsection 2d requires that any
-    application-supplied function or table used by this function must
-    be optional: if the application does not supply it, the square
-    root function must still compute square roots.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Library,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Library, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote
-it.

_service:tar_scm:audit-1644818677.13569e5.tar -> _service:tar_scm:audit-3.0.1.tar.gz Changed

_service:tar_scm:audit.yaml Added

_service:tar_scm:lgpl-2.1.txt Added

@@ -0,0 +1,502 @@
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+&#xc;
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+&#xc;
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+&#xc;
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.

Changes of Revision 2