开源软件构建与测试

_service:tar_scm:audit.spec Changed

@@ -1,8 +1,8 @@
 Summary:            User space tools for kernel auditing
 Name:               audit
 Epoch:              1
-Version:            3.0.9
-Release:            2
+Version:            3.1.1
+Release:            1
 License:            GPLv2+ and LGPLv2+
 URL:                https://people.redhat.com/sgrubb/audit/
 Source0:            https://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
@@ -14,7 +14,7 @@
 Patch3:          audit-Add-sw64-architecture.patch
 Patch4:          backport-audit-flex-array-workaround.patch
 Patch5:          backport-audit-undo-flex-array.patch
-Patch6:          backport-Try-to-interpret-OPENAT2-fields-correctly.patch
+Patch6:          backport-auditswig.i-avoid-setter-generation-for-audit_rule_d.patch
 
 BuildRequires:      gcc swig libtool systemd kernel-headers >= 2.6.29
 BuildRequires:      openldap-devel krb5-devel libcap-ng-devel
@@ -325,6 +325,7 @@
 %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/syslog.conf
 %attr(750,root,root) /sbin/audisp-remote
 %attr(750,root,root) /sbin/audisp-syslog
+%attr(750,root,root) /sbin/audisp-af_unix
 %attr(700,root,root) %dir %{_var}/spool/audit
 
 %files -n audispd-plugins-zos
@@ -365,6 +366,9 @@
 %attr(644,root,root) %{_mandir}/man8/*.8.gz
 
 %changelog
+* Mon Jul 24 2023 zhengxiaoxiao<zhengxiaoxiao2@huawei.com> - 1:3.1.1-1
+- update version to 3.1.1
+
 * Fri Mar 24 2023 dongyuzhen <dongyuzhen@h-partners.com> - 1:3.0.9-2
 - backport patches from upstream

_service:tar_scm:audit-Add-sw64-architecture.patch Changed

_service:tar_scm:backport-Try-to-interpret-OPENAT2-fields-correctly.patch Deleted

@@ -1,75 +0,0 @@
-From 83214d7469274dbd60959e32f6c26dda016de048 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Wed, 8 Feb 2023 13:45:32 -0500
-Subject: PATCH Try to interpret OPENAT2 fields correctly
-
-Conflict: delete ChangeLog
-Reference:https://github.com/linux-audit/audit-userspace/commit/83214d7469274dbd60959e32f6c26dda016de048
----
- auparse/interpret.c | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/auparse/interpret.c b/auparse/interpret.c
-index 373851f..4d2f0d4 100644
---- a/auparse/interpret.c
-+++ b/auparse/interpret.c
-@@ -1490,15 +1490,15 @@ static const char *print_success(const char *val)
- 		return strdup(val);
- }
- 
--static const char *print_open_flags(const char *val)
-+static const char *print_open_flags(const char *val, int base)
- {
- 	size_t i;
--	unsigned int flags;
-+	unsigned long flags;
- 	int cnt = 0;
- 	char *out, bufsizeof(open_flag_strings)+OPEN_FLAG_NUM_ENTRIES+1;
- 
- 	errno = 0;
--	flags = strtoul(val, NULL, 16);
-+	flags = strtoul(val, NULL, base);
-         if (errno) {
- 		if (asprintf(&out, "conversion error(%s)", val) < 0)
- 			out = NULL;
-@@ -2504,10 +2504,10 @@ static const char *print_a1(const char *val, const idata *id)
- 			else if (strcmp(sys, "mknod") == 0)
- 				return print_mode(val, 16);
- 			else if (strcmp(sys, "mq_open") == 0)
--				return print_open_flags(val);
-+				return print_open_flags(val, 16);
- 		}
- 		else if (strcmp(sys, "open") == 0)
--			return print_open_flags(val);
-+			return print_open_flags(val, 16);
- 		else if (strcmp(sys, "access") == 0)
- 			return print_access(val);
- 		else if (strcmp(sys, "epoll_ctl") == 0)
-@@ -2581,11 +2581,11 @@ static const char *print_a2(const char *val, const idata *id)
- 				goto normal;
- 		} else if (*sys == 'o') {
- 			if (strcmp(sys, "openat") == 0)
--				return print_open_flags(val);
-+				return print_open_flags(val, 16);
- 			if ((strcmp(sys, "open") == 0) && (id->a1 & O_CREAT))
- 				return print_mode_short(val, 16);
- 			if (strcmp(sys, "open_by_handle_at") == 0)
--			    return print_open_flags(val);
-+			    return print_open_flags(val, 16);
- 		} else if (*sys == 'f') {
- 			if (strcmp(sys, "fchmodat") == 0)
- 				return print_mode_short(val, 16);
-@@ -3256,8 +3256,8 @@ unknown:
- 		case AUPARSE_TYPE_SECCOMP:
- 			out = print_seccomp_code(id->val);
- 			break;
--		case AUPARSE_TYPE_OFLAG:
--			out = print_open_flags(id->val);
-+		case AUPARSE_TYPE_OFLAG: // AUDIT_OPENAT2,MQ_OPEN
-+			out = print_open_flags(id->val, 0);
- 			break;
- 		case AUPARSE_TYPE_MMAP:
- 			out = print_mmap(id->val);
--- 
-2.33.0
-

_service:tar_scm:backport-audit-flex-array-workaround.patch Changed

_service:tar_scm:backport-auditswig.i-avoid-setter-generation-for-audit_rule_d.patch Added

@@ -0,0 +1,39 @@
+From 1ca7e2b07bdc962695611ee1d0852f549d5ca21c Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyich@gmail.com>
+Date: Wed, 23 Mar 2022 07:27:05 +0000
+Subject: PATCH 10/12 auditswig.i: avoid setter generation for
+ audit_rule_data::buf
+
+As it's a flexible array generated code was never safe to use.
+With kernel's https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed98ea2128b6fd83bce13716edf8f5fe6c47f574
+change it's a build failure now:
+
+    audit> audit_wrap.c:5010:15: error: invalid use of flexible array member
+    audit>  5010 |     arg1->buf = (char )(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size));
+    audit>       |               ^
+
+Let's avoid setter generation entirely.
+
+Closes: https://github.com/linux-audit/audit-userspace/issues/252
+---
+ bindings/swig/src/auditswig.i | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/bindings/swig/src/auditswig.i b/bindings/swig/src/auditswig.i
+index 21aafca..9a2c566 100644
+--- a/bindings/swig/src/auditswig.i
++++ b/bindings/swig/src/auditswig.i
+@@ -39,6 +39,10 @@ signed
+ #define __attribute(X) /*nothing*/
+ typedef unsigned __u32;
+ typedef unsigned uid_t;
++/* Sidestep SWIG's limitation of handling c99 Flexible arrays by not:
++ * generating setters against them: https://github.com/swig/swig/issues/1699
++ */
++%ignore audit_rule_data::buf;
+ %include "../lib/audit.h"
+ #define __extension__ /*nothing*/
+ %include <stdint.i>
+-- 
+2.33.0
+

_service:tar_scm:audit-3.0.9.tar.gz/audisp/audispd-builtins.c Deleted

@@ -1,293 +0,0 @@
-/*
-* audispd-builtins.c - some common builtin plugins
-* Copyright (c) 2007,2010,2013,2018 Red Hat Inc., Durham, North Carolina.
-* All Rights Reserved. 
-*
-* This software may be freely redistributed and/or modified under the
-* terms of the GNU General Public License as published by the Free
-* Software Foundation; either version 2, or (at your option) any
-* later version.
-*
-* This program is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-* GNU General Public License for more details.
-*
-* You should have received a copy of the GNU General Public License
-* along with this program; see the file COPYING. If not, write to the
-* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
-* Boston, MA 02110-1335, USA.
-*
-* Authors:
-*   Steve Grubb <sgrubb@redhat.com>
-*/
-
-#include "config.h"
-#include <string.h>
-#include <dirent.h>
-#include <libgen.h>
-#include <ctype.h>
-#include <errno.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/un.h>
-#include <sys/stat.h>
-#include <sys/uio.h> // writev
-#include <fcntl.h>
-#include <stdio.h>
-#include "ev.h"
-#include "audispd-pconfig.h"
-#include "audispd-builtins.h"
-
-// Global data
-extern struct ev_loop *loop;
-
-// Local data
-static volatile int sock = -1, conn = -1;
-static char *path = NULL;
-static struct ev_io af_unix_watcher;
-
-// Local prototypes
-static void init_af_unix(const plugin_conf_t *conf);
-
-
-void start_builtin(plugin_conf_t *conf)
-{
-	if (strcasecmp("builtin_af_unix", conf->path) == 0) {
-		conf->type = S_AF_UNIX;
-		init_af_unix(conf);
-	} else
-		syslog(LOG_ERR, "Unknown builtin %s", conf->path);
-}
-
-void stop_builtin(plugin_conf_t *conf)
-{
-	if (conf->type == S_AF_UNIX)
-		destroy_af_unix();
-	else
-		syslog(LOG_ERR, "Unknown builtin %s", conf->path);
-}
-
-static int watching = 0;
-static void stop_watching(void)
-{
-	if (watching) {
-		ev_io_stop(loop, &af_unix_watcher);
-		watching = 0;
-	}
-}
-
-static void af_unix_accept(struct ev_loop *l, struct ev_io *_io, int revents)
-{
-	int cmd;
-
-	do {
-		conn = accept(_io->fd, NULL, NULL);
-	} while (conn < 0 && errno == EINTR);
-
-	// De-register since this is intended to be one listener
-	if (conn >= 0)
-		stop_watching();
-	cmd = fcntl(conn, F_GETFD);
-	fcntl(conn, F_SETFD, cmd|FD_CLOEXEC);
-}
-
-static void start_watching(void)
-{
-	ev_io_init(&af_unix_watcher, af_unix_accept, sock, EV_READ);
-	ev_io_start(loop, &af_unix_watcher);
-	watching = 1;
-}
-
-static int create_af_unix_socket(const char *spath, int mode)
-{
-	struct sockaddr_un addr;
-	socklen_t len;
-	int rc, cmd;
-
-	sock = socket(PF_UNIX, SOCK_STREAM, 0);
-	if (sock < 0) {
-		syslog(LOG_ERR, "Couldn't open af_unix socket (%s)",
-				strerror(errno));
-		return -1;
-	}
-	memset(&addr, 0, sizeof(addr));
-	addr.sun_family = AF_UNIX;
-	snprintf(&addr.sun_path0, 108, "%.107s", spath);
-	len = sizeof(addr);
-	rc = bind(sock, (const struct sockaddr *)&addr,	len);
-	if (rc < 0) {
-		syslog(LOG_ERR, "Couldn't bind af_unix socket (%s)",
-				strerror(errno));
-		destroy_af_unix();
-		return -1;
-	}
-	if (mode != -1) {
-		rc = chmod(spath, mode);
-		if (rc < 0) {
-			syslog(LOG_ERR, "Couldn't chmod %s to %04o (%s)",
-				spath, mode, strerror(errno));
-			destroy_af_unix();
-			return -1;
-		}
-	}
-
-	// Put socket in nonblock mode
-	cmd = fcntl(sock, F_GETFL);
-	fcntl(sock, F_SETFL, cmd|FNDELAY);
-
-	// don't leak the descriptor
-	cmd = fcntl(sock, F_GETFD);
-	fcntl(sock, F_SETFD, cmd|FD_CLOEXEC);
-
-	// Make socket listening...won't block
-	(void)listen(sock, 5);
-
-	// Register socket with libev
-	start_watching();
-	return 0;
-}
-
-static void init_af_unix(const plugin_conf_t *conf)
-{
-	int i = 1, mode = -1;
-	char *base = NULL;
-
-	// while args
-	while (conf->argsi) {
-		int rc, bad = 0;
-
-		// is all nums - do mode
-		base = conf->argsi;
-		while (*base) {
-			if (!isdigit(*base)) {
-				bad = 1;
-				break;
-			}
-			base++;
-		}
-		if (!bad) {
-			errno = 0;
-			mode = strtoul(conf->argsi, NULL, 8);
-			if (errno) {
-				syslog(LOG_ERR, "Error converting %s (%s)",
-					conf->argsi, strerror(errno));
-				mode = -1;
-				bad = 1;
-			} else if (path) {
-				rc = chmod(path, mode);
-				if (rc < 0) {
-					syslog(LOG_ERR,
-					    "Couldn't chmod %s to %04o (%s)",
-						conf->argsi, mode,
-						strerror(errno));
-					destroy_af_unix();
-					return;
-				}
-			}
-		} else {
-			// else check for '/'
-			base = strchr(conf->argsi, '/');
-			if (base) {
-				// get dirname
-				DIR *d;
-				char *dir = strdup(conf->argsi);
-				base = dirname(dir);
-				d = opendir(base);
-				if (d) {
-					closedir(d);
-					unlink(conf->argsi);

_service:tar_scm:audit-3.0.9.tar.gz/audisp/audispd-builtins.h Deleted

@@ -1,41 +0,0 @@
-/*
-* audispd-builtins.h - Interface to builtin plugins
-* Copyright (c) 2007,2013,2018,2022 Red Hat Inc.
-* All Rights Reserved.
-*
-* This software may be freely redistributed and/or modified under the
-* terms of the GNU General Public License as published by the Free
-* Software Foundation; either version 2, or (at your option) any
-* later version.
-*
-* This program is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-* GNU General Public License for more details.
-*
-* You should have received a copy of the GNU General Public License
-* along with this program; see the file COPYING. If not, write to the
- * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
- * Boston, MA 02110-1335, USA.
-*
-* Authors:
-*   Steve Grubb <sgrubb@redhat.com>
-*/
-
-#ifndef AUDISPD_BUILTINS_HEADER
-#define AUDISPD_BUILTINS_HEADER
-
-#include "queue.h"
-#ifndef __attr_access
-#  define __attr_access(x)
-#endif
-
-void start_builtin(plugin_conf_t *conf);
-void stop_builtin(plugin_conf_t *conf);
-void send_af_unix_string(const char *s, unsigned int len)
-	__attr_access ((__read_only__, 1, 2));
-void send_af_unix_binary(event_t *e);
-void destroy_af_unix(void);
-
-#endif
-

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/builtins Deleted

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/builtins/Makefile.am Deleted

@@ -1,40 +0,0 @@
-# Makefile.am--
-# Copyright 2007 Red Hat Inc., Durham, North Carolina.
-# All Rights Reserved.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; see the file COPYING. If not, write to the
-# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
-# Boston, MA 02110-1335, USA.
-#
-# Authors:
-#   Steve Grubb <sgrubb@redhat.com>
-#
-
-CONFIG_CLEAN_FILES = *.rej *.orig
-CONF_FILES = af_unix.conf
-EXTRA_DIST = $(CONF_FILES)
-plugin_confdir=$(sysconfdir)/audit/plugins.d
-
-install-data-hook:
-	mkdir -p -m 0750 ${DESTDIR}${plugin_confdir}
-	for i in $(CONF_FILES); do \
-		$(INSTALL_DATA) -D -m 640 ${srcdir}/"$$i" \
-			${DESTDIR}${plugin_confdir}; \
-	done
-
-uninstall-hook:
-	for i in $(CONF_FILES); do \
-		rm ${DESTDIR}${plugin_confdir}/"$$i"; \
-	done
-

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/builtins/Makefile.in Deleted

@@ -1,524 +0,0 @@
-# Makefile.in generated by automake 1.16.5 from Makefile.am.
-# @configure_input@
-
-# Copyright (C) 1994-2021 Free Software Foundation, Inc.
-
-# This Makefile.in is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-@SET_MAKE@
-
-# Makefile.am--
-# Copyright 2007 Red Hat Inc., Durham, North Carolina.
-# All Rights Reserved.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; see the file COPYING. If not, write to the
-# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
-# Boston, MA 02110-1335, USA.
-#
-# Authors:
-#   Steve Grubb <sgrubb@redhat.com>
-#
-VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
-am__make_running_with_option = \
-  case $${target_option-} in \
-      ?) ;; \
-      *) echo "am__make_running_with_option: internal error: invalid" \
-              "target option '$${target_option-}' specified" >&2; \
-         exit 1;; \
-  esac; \
-  has_opt=no; \
-  sane_makeflags=$$MAKEFLAGS; \
-  if $(am__is_gnu_make); then \
-    sane_makeflags=$$MFLAGS; \
-  else \
-    case $$MAKEFLAGS in \
-      *\\\ \	*) \
-        bs=\\; \
-        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
-          | sed "s/$$bs$$bs$$bs $$bs	*//g"`;; \
-    esac; \
-  fi; \
-  skip_next=no; \
-  strip_trailopt () \
-  { \
-    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
-  }; \
-  for flg in $$sane_makeflags; do \
-    test $$skip_next = yes && { skip_next=no; continue; }; \
-    case $$flg in \
-      *=*|--*) continue;; \
-        -*I) strip_trailopt 'I'; skip_next=yes;; \
-      -*I?*) strip_trailopt 'I';; \
-        -*O) strip_trailopt 'O'; skip_next=yes;; \
-      -*O?*) strip_trailopt 'O';; \
-        -*l) strip_trailopt 'l'; skip_next=yes;; \
-      -*l?*) strip_trailopt 'l';; \
-      -dEDm) skip_next=yes;; \
-      -JT) skip_next=yes;; \
-    esac; \
-    case $$flg in \
-      *$$target_option*) has_opt=yes; break;; \
-    esac; \
-  done; \
-  test $$has_opt = yes
-am__make_dryrun = (target_option=n; $(am__make_running_with_option))
-am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
-pkgdatadir = $(datadir)/@PACKAGE@
-pkgincludedir = $(includedir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
-pkglibexecdir = $(libexecdir)/@PACKAGE@
-am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
-install_sh_DATA = $(install_sh) -c -m 644
-install_sh_PROGRAM = $(install_sh) -c
-install_sh_SCRIPT = $(install_sh) -c
-INSTALL_HEADER = $(INSTALL_DATA)
-transform = $(program_transform_name)
-NORMAL_INSTALL = :
-PRE_INSTALL = :
-POST_INSTALL = :
-NORMAL_UNINSTALL = :
-PRE_UNINSTALL = :
-POST_UNINSTALL = :
-build_triplet = @build@
-host_triplet = @host@
-target_triplet = @target@
-subdir = audisp/plugins/builtins
-ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/m4/ax_prog_cc_for_build.m4 \
-	$(top_srcdir)/m4/cap-ng.m4 $(top_srcdir)/m4/libtool.m4 \
-	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
-	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
-	$(top_srcdir)/src/libev/libev.m4 $(top_srcdir)/configure.ac
-am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
-	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
-mkinstalldirs = $(install_sh) -d
-CONFIG_HEADER = $(top_builddir)/config.h
-CONFIG_CLEAN_VPATH_FILES =
-AM_V_P = $(am__v_P_@AM_V@)
-am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
-am__v_P_0 = false
-am__v_P_1 = :
-AM_V_GEN = $(am__v_GEN_@AM_V@)
-am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
-am__v_GEN_0 = @echo "  GEN     " $@;
-am__v_GEN_1 = 
-AM_V_at = $(am__v_at_@AM_V@)
-am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
-am__v_at_0 = @
-am__v_at_1 = 
-SOURCES =
-DIST_SOURCES =
-am__can_run_installinfo = \
-  case $$AM_UPDATE_INFO_DIR in \
-    n|no|NO) false;; \
-    *) (install-info --version) >/dev/null 2>&1;; \
-  esac
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
-am__DIST_COMMON = $(srcdir)/Makefile.in
-DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
-ACLOCAL = @ACLOCAL@
-AMTAR = @AMTAR@
-AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
-AR = @AR@
-AUTOCONF = @AUTOCONF@
-AUTOHEADER = @AUTOHEADER@
-AUTOMAKE = @AUTOMAKE@
-AWK = @AWK@
-BUILD_EXEEXT = @BUILD_EXEEXT@
-BUILD_OBJEXT = @BUILD_OBJEXT@
-CAPNG_LDADD = @CAPNG_LDADD@
-CC = @CC@
-CCDEPMODE = @CCDEPMODE@
-CC_FOR_BUILD = @CC_FOR_BUILD@
-CFLAGS = @CFLAGS@
-CFLAGS_FOR_BUILD = @CFLAGS_FOR_BUILD@
-CPP = @CPP@
-CPPFLAGS = @CPPFLAGS@
-CPPFLAGS_FOR_BUILD = @CPPFLAGS_FOR_BUILD@
-CPP_FOR_BUILD = @CPP_FOR_BUILD@
-CSCOPE = @CSCOPE@
-CTAGS = @CTAGS@
-CYGPATH_W = @CYGPATH_W@
-DEBUG = @DEBUG@
-DEFS = @DEFS@
-DEPDIR = @DEPDIR@
-DLLTOOL = @DLLTOOL@
-DSYMUTIL = @DSYMUTIL@
-DUMPBIN = @DUMPBIN@
-ECHO_C = @ECHO_C@
-ECHO_N = @ECHO_N@
-ECHO_T = @ECHO_T@
-EGREP = @EGREP@
-ETAGS = @ETAGS@
-EXEEXT = @EXEEXT@
-FGREP = @FGREP@
-FILECMD = @FILECMD@
-GOLANG = @GOLANG@
-GOROOT = @GOROOT@
-GREP = @GREP@
-INSTALL = @INSTALL@
-INSTALL_DATA = @INSTALL_DATA@
-INSTALL_PROGRAM = @INSTALL_PROGRAM@
-INSTALL_SCRIPT = @INSTALL_SCRIPT@
-INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-LD = @LD@
-LDFLAGS = @LDFLAGS@
-LDFLAGS_FOR_BUILD = @LDFLAGS_FOR_BUILD@
-LIBOBJS = @LIBOBJS@
-LIBS = @LIBS@
-LIBTOOL = @LIBTOOL@

_service:tar_scm:audit-3.0.9.tar.gz/ChangeLog -> _service:tar_scm:audit-3.1.1.tar.gz/ChangeLog Changed

@@ -1,3 +1,21 @@
+3.1.1
+- Add user friendly keywords for signals to auditctl
+- In ausearch, parse up URINGOP and DM_CTRL records
+- Harden auparse to better handle corrupt logs
+- Fix a CFLAGS propogation problem in the common directory
+- Move the audispd af_unix plugin to a standalone program
+
+3.1
+- Disable ProtectControlGroups in auditd.service by default
+- Fix rule checking for exclude filter
+- Make audit_rule_syscallbyname_data work correctly outside of auditctl
+- Add new record types
+- Add io_uring support
+- Add support for new FANOTIFY record fields
+- Add keyword, this-hour, to ausearch/report start/end options
+- Add Requires.private to audit.pc file
+- Try to interpret OPENAT2 fields correctly
+
 3.0.9
 - In auditd, release the async flush lock on stop
 - Don't allow auditd to log directly into /var/log when log_group is non-zero
@@ -145,7 +163,7 @@
 - Fix memleak in auparse caused by corrected event ordering
 - Fix legacy reload script to reload audit rules when daemon is reloaded
 - Support for unescaping in trusted messages (Dmitry Voronin)
-- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
+- In auditd, use standard template for DAEMON events (Richard Guy Briggs)
 - In aureport, fix segfault for malformed USER_CMD events
 - Add exe field to audit_log_user_command in libaudit
 - In auditctl support filter on socket address families (Richard Guy Briggs)

_service:tar_scm:audit-3.0.9.tar.gz/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/TODO -> _service:tar_scm:audit-3.1.1.tar.gz/TODO Changed

_service:tar_scm:audit-3.0.9.tar.gz/aclocal.m4 -> _service:tar_scm:audit-3.1.1.tar.gz/aclocal.m4 Changed

@@ -732,35 +732,6 @@
 fi
 )
 
-#  -*- Autoconf -*-
-# Obsolete and "removed" macros, that must however still report explicit
-# error messages when used, to smooth transition.
-#
-# Copyright (C) 1996-2021 Free Software Foundation, Inc.
-#
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-AC_DEFUN(AM_CONFIG_HEADER,
-AC_DIAGNOSE(obsolete,
-'$0': this macro is obsolete.
-You should use the 'AC_CONFIG_HEADERS' macro instead.)dnl
-AC_CONFIG_HEADERS($@))
-
-AC_DEFUN(AM_PROG_CC_STDC,
-AC_PROG_CC
-am_cv_prog_cc_stdc=$ac_cv_prog_cc_stdc
-AC_DIAGNOSE(obsolete,
-'$0': this macro is obsolete.
-You should simply use the 'AC_PROG_CC' macro instead.
-Also, your code should no longer depend upon 'am_cv_prog_cc_stdc',
-but upon 'ac_cv_prog_cc_stdc'.))
-
-AC_DEFUN(AM_C_PROTOTYPES,
-         AC_FATAL(automatic de-ANSI-fication support has been removed))
-AU_DEFUN(fp_C_PROTOTYPES, AM_C_PROTOTYPES)
-
 # Helper functions for option handling.                     -*- Autoconf -*-
 
 # Copyright (C) 2001-2021 Free Software Foundation, Inc.

_service:tar_scm:audit-3.0.9.tar.gz/audisp/Makefile.am -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/Makefile.am Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/Makefile.in Changed

@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 # Makefile.am-- 
-# Copyright 2007,2011,2015-16,2018 Red Hat Inc., Durham, North Carolina.
+# Copyright 2007,2011,2015-23 Red Hat Inc.
 # All Rights Reserved.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -131,7 +131,7 @@
 libdisp_la_LIBADD =
 am_libdisp_la_OBJECTS = libdisp_la-audispd.lo \
 	libdisp_la-audispd-pconfig.lo libdisp_la-queue.lo \
-	libdisp_la-audispd-llist.lo libdisp_la-audispd-builtins.lo
+	libdisp_la-audispd-llist.lo
 libdisp_la_OBJECTS = $(am_libdisp_la_OBJECTS)
 AM_V_lt = $(am__v_lt_@AM_V@)
 am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
@@ -155,8 +155,7 @@
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__maybe_remake_depfiles = depfiles
-am__depfiles_remade = ./$(DEPDIR)/libdisp_la-audispd-builtins.Plo \
-	./$(DEPDIR)/libdisp_la-audispd-llist.Plo \
+am__depfiles_remade = ./$(DEPDIR)/libdisp_la-audispd-llist.Plo \
 	./$(DEPDIR)/libdisp_la-audispd-pconfig.Plo \
 	./$(DEPDIR)/libdisp_la-audispd.Plo \
 	./$(DEPDIR)/libdisp_la-queue.Plo
@@ -259,6 +258,7 @@
 BUILD_EXEEXT = @BUILD_EXEEXT@
 BUILD_OBJEXT = @BUILD_OBJEXT@
 CAPNG_LDADD = @CAPNG_LDADD@
+CAPNG_PKG = @CAPNG_PKG@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CC_FOR_BUILD = @CC_FOR_BUILD@
@@ -339,6 +339,7 @@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
+SWIG = @SWIG@
 VERSION = @VERSION@
 WFLAGS = @WFLAGS@
 abs_builddir = @abs_builddir@
@@ -413,10 +414,10 @@
 AM_CPPFLAGS = -D_GNU_SOURCE -fPIC -DPIC -I${top_srcdir} -I${top_srcdir}/lib -I${top_srcdir}/src -I${top_srcdir}/src/libev
 LDADD = -lpthread
 noinst_HEADERS = audispd-pconfig.h audispd-llist.h audispd-config.h \
-	queue.h audispd-builtins.h libdisp.h
+	queue.h libdisp.h
 
 libdisp_la_SOURCES = audispd.c audispd-pconfig.c queue.c \
-	audispd-llist.c audispd-builtins.c
+	audispd-llist.c
 
 libdisp_la_CFLAGS = -fno-strict-aliasing ${WFLAGS}
 libdisp_la_LDFLAGS = -no-undefined -static
@@ -475,7 +476,6 @@
 distclean-compile:
 	-rm -f *.tab.c
 
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libdisp_la-audispd-builtins.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libdisp_la-audispd-llist.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libdisp_la-audispd-pconfig.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libdisp_la-audispd.Plo@am__quote@ # am--include-marker
@@ -536,13 +536,6 @@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libdisp_la_CFLAGS) $(CFLAGS) -c -o libdisp_la-audispd-llist.lo `test -f 'audispd-llist.c' || echo '$(srcdir)/'`audispd-llist.c
 
-libdisp_la-audispd-builtins.lo: audispd-builtins.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libdisp_la_CFLAGS) $(CFLAGS) -MT libdisp_la-audispd-builtins.lo -MD -MP -MF $(DEPDIR)/libdisp_la-audispd-builtins.Tpo -c -o libdisp_la-audispd-builtins.lo `test -f 'audispd-builtins.c' || echo '$(srcdir)/'`audispd-builtins.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libdisp_la-audispd-builtins.Tpo $(DEPDIR)/libdisp_la-audispd-builtins.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='audispd-builtins.c' object='libdisp_la-audispd-builtins.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libdisp_la_CFLAGS) $(CFLAGS) -c -o libdisp_la-audispd-builtins.lo `test -f 'audispd-builtins.c' || echo '$(srcdir)/'`audispd-builtins.c
-
 mostlyclean-libtool:
 	-rm -f *.lo
 
@@ -746,8 +739,7 @@
 	mostlyclean-am
 
 distclean: distclean-recursive
-		-rm -f ./$(DEPDIR)/libdisp_la-audispd-builtins.Plo
-	-rm -f ./$(DEPDIR)/libdisp_la-audispd-llist.Plo
+		-rm -f ./$(DEPDIR)/libdisp_la-audispd-llist.Plo
 	-rm -f ./$(DEPDIR)/libdisp_la-audispd-pconfig.Plo
 	-rm -f ./$(DEPDIR)/libdisp_la-audispd.Plo
 	-rm -f ./$(DEPDIR)/libdisp_la-queue.Plo
@@ -796,8 +788,7 @@
 installcheck-am:
 
 maintainer-clean: maintainer-clean-recursive
-		-rm -f ./$(DEPDIR)/libdisp_la-audispd-builtins.Plo
-	-rm -f ./$(DEPDIR)/libdisp_la-audispd-llist.Plo
+		-rm -f ./$(DEPDIR)/libdisp_la-audispd-llist.Plo
 	-rm -f ./$(DEPDIR)/libdisp_la-audispd-pconfig.Plo
 	-rm -f ./$(DEPDIR)/libdisp_la-audispd.Plo
 	-rm -f ./$(DEPDIR)/libdisp_la-queue.Plo

_service:tar_scm:audit-3.0.9.tar.gz/audisp/audispd-pconfig.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/audispd-pconfig.c Changed

@@ -1,11 +1,11 @@
 /* audispd-pconfig.c --
- * Copyright 2007,2010,2015,2021 Red Hat Inc.
+ * Copyright 2007,2010,2015,2021-23 Red Hat Inc.
  * All Rights Reserved.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2, or (at your option) any
+ * later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -13,8 +13,9 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * along with this program; see the file COPYING. If not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
+ * Boston, MA 02110-1335, USA.
  *
  * Authors:
  *   Steve Grubb <sgrubb@redhat.com>
@@ -378,6 +379,7 @@
 	return 1;
 }
 
+static const char *BUILTIN_PATH="/sbin/audisp-af_unix";
 static int path_parser(struct nv_pair *nv, int line,
 	plugin_conf_t *config)
 {
@@ -389,7 +391,10 @@
 	}
 
 	if (strncasecmp(nv->value, "builtin_", 8) == 0) {
-		config->path = strdup(nv->value);
+		audit_msg(LOG_WARNING,
+			  "Option %s line %d is obsolete - using %s",
+			  nv->value, line, BUILTIN_PATH);
+		config->path = strdup(BUILTIN_PATH);
 		return 0;
 	}
 
@@ -421,6 +426,11 @@
 	for (i=0; service_typei.name != NULL; i++) {
 		if (strcasecmp(nv->value, service_typei.name) == 0) {
 			config->type = service_typei.option;
+			if (config->type == S_BUILTIN) {
+				audit_msg(LOG_WARNING,
+		"Option %s line %d is obsolete - update it", nv->value, line);
+				config->type = S_ALWAYS;
+			}
 			return 0;
 		}
 	}

_service:tar_scm:audit-3.0.9.tar.gz/audisp/audispd-pconfig.h -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/audispd-pconfig.h Changed

@@ -1,11 +1,11 @@
-/* audispd-pconfig.h -- 
- * Copyright 2007,2013 Red Hat Inc., Durham, North Carolina.
+/* audispd-pconfig.h --
+ * Copyright 2007,2013,2023 Red Hat Inc.
  * All Rights Reserved.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2, or (at your option) any
+ * later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -13,12 +13,12 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * along with this program; see the file COPYING. If not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
+ * Boston, MA 02110-1335, USA.
  *
  * Authors:
  *   Steve Grubb <sgrubb@redhat.com>
- * 
  */
 
 #ifndef AUDISPD_PCONFIG_H
@@ -30,7 +30,7 @@
 
 typedef enum { A_NO, A_YES } active_t;
 typedef enum { D_UNSET, D_IN, D_OUT } direction_t;
-typedef enum { S_ALWAYS, S_BUILTIN, S_AF_UNIX } service_t;
+typedef enum { S_ALWAYS, S_BUILTIN } service_t;
 typedef enum { F_BINARY, F_STRING } format_t;
 
 typedef struct plugin_conf

_service:tar_scm:audit-3.0.9.tar.gz/audisp/audispd.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/audispd.c Changed

@@ -1,11 +1,11 @@
 /* audispd.c --
- * Copyright 2007-08,2013,2016-18 Red Hat Inc.
+ * Copyright 2007-08,2013,2016-23 Red Hat Inc.
  * All Rights Reserved.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2, or (at your option) any
+ * later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -13,8 +13,9 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * along with this program; see the file COPYING. If not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
+ * Boston, MA 02110-1335, USA.
  *
  * Authors:
  *   Steve Grubb <sgrubb@redhat.com>
@@ -40,7 +41,6 @@
 #include "audispd-pconfig.h"
 #include "audispd-config.h"
 #include "audispd-llist.h"
-#include "audispd-builtins.h"
 #include "queue.h"
 #include "libaudit.h"
 #include "private.h"
@@ -137,9 +137,7 @@
 	if (conf->p->restart_cnt > daemon_config.max_restarts)
 		return 1;
 
-	if (conf->p->type == S_BUILTIN)
-		start_builtin(conf->p);
-	else if (conf->p->type == S_ALWAYS) {
+	if (conf->p->type == S_ALWAYS) {
 		if (safe_exec(conf->p)) {
 			audit_msg(LOG_ERR,
 				"Error running %s (%s) continuing without it",
@@ -288,8 +286,7 @@
 			if (tpconf->p->pid)
 				kill(tpconf->p->pid, SIGTERM);
 			close(tpconf->p->plug_pipe1);
-		} else
-			stop_builtin(tpconf->p);
+		}
 		tpconf->p->plug_pipe1 = -1;
 		tpconf->p->pid = 0;
 		tpconf->p->checked = 1;
@@ -379,9 +376,6 @@
 	/* Tell plugins we are going down */
 	signal_plugins(SIGTERM);
 
-	/* Cleanup builtin plugins */
-	destroy_af_unix();
-
 	/* Release configs */
 	plist_first(&plugin_conf);
 	conf = plist_get_cur(&plugin_conf);
@@ -537,13 +531,8 @@
 			if (conf->p->active == A_NO || stop)
 				continue;
 
-			/* Now send the event to the right child */
-			if (conf->p->type == S_AF_UNIX) {
-				if (conf->p->format == F_STRING)
-					send_af_unix_string(v, len);
-				else
-					send_af_unix_binary(e);
-			} else if (conf->p->type == S_ALWAYS && !stop) {
+			/* Now send the event to the child */
+			if (conf->p->type == S_ALWAYS && !stop) {
 				int rc;
 				rc = write_to_plugin(e, v, len, conf);
 				if (rc < 0 && errno == EPIPE) {

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/Makefile.am -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/Makefile.am Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/Makefile.in Changed

@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 # Makefile.am --
-# Copyright 2007-08,2018,2021 Red Hat Inc.
+# Copyright 2007-08,2018-23 Red Hat Inc.
 # All Rights Reserved.
 #
 # This library is free software; you can redistribute it and/or
@@ -178,7 +178,7 @@
   unique=`for i in $$list; do \
     if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
   done | $(am__uniquify_input)`
-DIST_SUBDIRS = builtins remote syslog ids statsd zos-remote
+DIST_SUBDIRS = af_unix remote syslog ids statsd zos-remote
 am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 am__relativize = \
@@ -217,6 +217,7 @@
 BUILD_EXEEXT = @BUILD_EXEEXT@
 BUILD_OBJEXT = @BUILD_OBJEXT@
 CAPNG_LDADD = @CAPNG_LDADD@
+CAPNG_PKG = @CAPNG_PKG@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CC_FOR_BUILD = @CC_FOR_BUILD@
@@ -297,6 +298,7 @@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
+SWIG = @SWIG@
 VERSION = @VERSION@
 WFLAGS = @WFLAGS@
 abs_builddir = @abs_builddir@
@@ -367,7 +369,7 @@
 top_srcdir = @top_srcdir@
 use_python3 = @use_python3@
 CONFIG_CLEAN_FILES = *.loT *.rej *.orig
-SUBDIRS = builtins remote syslog $(am__append_1) $(am__append_2)
+SUBDIRS = af_unix remote syslog $(am__append_1) $(am__append_2)
 all: all-recursive
 
 .SUFFIXES:

_service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/af_unix Added

_service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/af_unix/Makefile.am Added

@@ -0,0 +1,52 @@
+# Makefile.am--
+# Copyright 2023 Red Hat Inc.
+# All Rights Reserved.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; see the file COPYING. If not, write to the
+# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
+# Boston, MA 02110-1335, USA.
+#
+# Authors:
+#   Steve Grubb <sgrubb@redhat.com>
+#
+
+CONFIG_CLEAN_FILES = *.rej *.orig
+CONF_FILES = af_unix.conf
+EXTRA_DIST = $(CONF_FILES) $(man_MANS)
+
+AM_CPPFLAGS = -I${top_srcdir} -I${top_srcdir}/lib -I${top_srcdir}/common
+prog_confdir = $(sysconfdir)/audit
+plugin_confdir=$(prog_confdir)/plugins.d
+plugin_conf = af_unix.conf
+sbin_PROGRAMS = audisp-af_unix
+man_MANS = audisp-af_unix.8
+
+audisp_af_unix_DEPENDENCIES = ${top_builddir}/common/libaucommon.la
+audisp_af_unix_SOURCES = audisp-af_unix.c
+audisp_af_unix_CFLAGS = -fPIE -DPIE -g -D_GNU_SOURCE -Wundef ${WFLAGS}
+audisp_af_unix_LDFLAGS = -pie -Wl,-z,relro -Wl,-z,now
+audisp_af_unix_LDADD = $(CAPNG_LDADD) ${top_builddir}/common/libaucommon.la
+
+install-data-hook:
+	mkdir -p -m 0750 ${DESTDIR}${plugin_confdir}
+	for i in $(CONF_FILES); do \
+		$(INSTALL_DATA) -D -m 640 ${srcdir}/"$$i" \
+			${DESTDIR}${plugin_confdir}; \
+	done
+
+uninstall-hook:
+	for i in $(CONF_FILES); do \
+		rm ${DESTDIR}${plugin_confdir}/"$$i"; \
+	done
+

_service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/af_unix/Makefile.in Added

@@ -0,0 +1,824 @@
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+# Makefile.am--
+# Copyright 2023 Red Hat Inc.
+# All Rights Reserved.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; see the file COPYING. If not, write to the
+# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
+# Boston, MA 02110-1335, USA.
+#
+# Authors:
+#   Steve Grubb <sgrubb@redhat.com>
+#
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\\ \	*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs$$bs $$bs	*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -dEDm) skip_next=yes;; \
+      -JT) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+target_triplet = @target@
+sbin_PROGRAMS = audisp-af_unix$(EXEEXT)
+subdir = audisp/plugins/af_unix
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/ax_prog_cc_for_build.m4 \
+	$(top_srcdir)/m4/cap-ng.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/src/libev/libev.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_VPATH_FILES =
+am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man8dir)"
+PROGRAMS = $(sbin_PROGRAMS)
+am_audisp_af_unix_OBJECTS = audisp_af_unix-audisp-af_unix.$(OBJEXT)
+audisp_af_unix_OBJECTS = $(am_audisp_af_unix_OBJECTS)
+am__DEPENDENCIES_1 =
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+audisp_af_unix_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(audisp_af_unix_CFLAGS) $(CFLAGS) $(audisp_af_unix_LDFLAGS) \
+	$(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__maybe_remake_depfiles = depfiles
+am__depfiles_remade = ./$(DEPDIR)/audisp_af_unix-audisp-af_unix.Po
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(audisp_af_unix_SOURCES)
+DIST_SOURCES = $(audisp_af_unix_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*|/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,$ .*$/^/*$$,\1,' | \
+  $(AWK) 'BEGIN { files"." = "" } { files$$2 = files$$2 " " $$1; \
+    if (++n$$2 == $(am__install_max)) \

_service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/af_unix/af_unix.conf Changed

_service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/af_unix/audisp-af_unix.8 Added

_service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/af_unix/audisp-af_unix.c Added

@@ -0,0 +1,326 @@
+/*
+ * af_unix.c - implementation of the audisp-af_unix plugin
+ * Copyright (c) 2023 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2, or (at your option) any
+ * later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING. If not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
+ * Boston, MA 02110-1335, USA.
+ *
+ * Authors:
+ *   Steve Grubb <sgrubb@redhat.com>
+ */
+
+#include "config.h"
+#include <stdio.h>
+#include <syslog.h>
+#include <ctype.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+#include <libgen.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <dirent.h>
+#include <sys/un.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <sys/socket.h>
+#ifdef HAVE_LIBCAP_NG
+#include <cap-ng.h>
+#endif
+#include "libaudit.h"
+#include "common.h"
+
+#define DEFAULT_PATH "/var/run/audispd_events"
+//#define DEBUG
+
+/* Global Data */
+static volatile int stop = 0, hup = 0;
+char rx_bufMAX_AUDIT_MESSAGE_LENGTH;
+int sock = -1, conn = -1, client = 0;
+struct pollfd pfd3;
+unsigned mode = 0;
+char *path = NULL;
+
+/*
+ * SIGTERM handler
+ */
+static void term_handler(int sig)
+{
+	stop = 1;
+}
+
+/*
+ * SIGHUP handler: re-read config
+ */
+static void hup_handler(int sig)
+{
+	hup = 1;
+}
+
+int create_af_unix_socket(const char *spath, int mode)
+{
+	struct sockaddr_un addr;
+	socklen_t len;
+	int rc, cmd, one = 1;
+
+	sock = socket(PF_UNIX, SOCK_STREAM, 0);
+	if (sock < 0) {
+		syslog(LOG_ERR, "Couldn't open af_unix socket (%s)",
+		       strerror(errno));
+		return -1;
+	}
+	setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
+			(char *)&one, sizeof (int));
+#ifdef DEBUG
+	printf("%o %s\n", mode, spath);
+#else
+	memset(&addr, 0, sizeof(addr));
+	addr.sun_family = AF_UNIX;
+	snprintf(&addr.sun_path0, 108, "%.107s", spath);
+	len = sizeof(addr);
+	rc = bind(sock, (const struct sockaddr *)&addr, len);
+	if (rc < 0) {
+		syslog(LOG_ERR, "Couldn't bind af_unix socket (%s)",
+		       strerror(errno));
+		close(sock);
+		return -1;
+	}
+	rc = chmod(spath, mode);
+	if (rc < 0) {
+		syslog(LOG_ERR, "Couldn't chmod %s to %04o (%s)",
+		       spath, mode, strerror(errno));
+		close(sock);
+		unlink(spath);
+		return -1;
+	}
+	// Put socket in nonblock mode and don't leak the descriptor
+	cmd = fcntl(sock, F_GETFL);
+	fcntl(sock, F_SETFL, cmd|FNDELAY|FD_CLOEXEC);
+
+	// Make socket listening...won't block
+	(void)listen(sock, 1);
+#endif
+	return 0;
+}
+
+int setup_socket(int argc, char *argv)
+{
+	if (argc != 3) {
+		syslog(LOG_ERR, "Missing arguments, using defaults");
+		mode = 0640;
+		path = DEFAULT_PATH;
+	} else {
+		int i;
+		for (i=1; i < 3; i++) {
+			if (isdigit(argvi0)) {
+				errno = 0;
+				mode = strtoul(argvi, NULL, 8);
+				if (errno) {
+					syslog(LOG_ERR,
+					       "Error converting %s (%s)",
+					       argvi, strerror(errno));
+					mode = 0;
+				}
+			} else {
+				char *base;
+				path = argvi;
+				// Make sure there are directories
+				base = strchr(path, '/');
+				if (base) {
+					DIR *d;
+					char *dir = strdup(path);
+					base = dirname(dir);
+					d = opendir(base);
+					if (d) {
+						closedir(d);
+						unlink(path);
+						free(dir);
+					} else {
+						syslog(LOG_ERR,
+						       "Couldn't open %s (%s)",
+						       base, strerror(errno));
+						free(dir);
+						exit(1);
+					}
+
+				} else {
+					syslog(LOG_ERR, "Malformed path %s",
+					       path);
+					exit(1);
+				}
+			}
+		}
+		if (mode == 0 || path == NULL) {
+			syslog(LOG_ERR, "Bad arguments, using defaults");
+			mode = 0640;
+			path = DEFAULT_PATH;
+		}
+	}
+	return create_af_unix_socket(path, mode);
+}
+
+void read_audit_record(int ifd)
+{
+	do {
+		int len;
+
+		// Read stdin
+		if ((len = audit_fgets(rx_buf, sizeof(rx_buf), ifd)) > 0) {
+#ifdef DEBUG
+			write(1, rx_buf, len);
+#else
+			if (client) {
+				// Send it to the client
+				int rc;
+
+				do {
+					rc = write(conn, rx_buf, len);
+				} while (rc < 0 && errno == EINTR);
+				if (rc < 0 && errno == EPIPE) {
+					close(conn);
+					conn = -1;
+					client = 0;
+					audit_fgets_clear();
+				}
+				if (rc >= 0 && rc != len) {

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/account.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/account.c Changed

@@ -15,7 +15,7 @@
 
 // This holds info about all sessions
 struct account_avl{
-	avl_tree index;
+	avl_tree_t index;
 	unsigned int count;
 };
 
@@ -70,10 +70,10 @@
 
 static void destroy_account(void)
 {
-	avl *cur = accounts.index.root;
+	avl_t *cur = accounts.index.root;
 
 	account_data_t *a = (account_data_t *)avl_remove(&accounts.index, cur);
-	if ((avl *)a != cur)
+	if ((avl_t *)a != cur)
 		my_printf("account: removal of invalid node");
 
 	// Now free any data pointed to by cur
@@ -106,7 +106,7 @@
 		my_printf("Adding account %s", a->name);
 
 	cur = NULL;
-	tmp = (account_data_t *)avl_insert(&accounts.index, (avl *)(a));
+	tmp = (account_data_t *)avl_insert(&accounts.index, (avl_t *)(a));
 	if (tmp) {
 		if (tmp != a) {
 			if (debug)
@@ -129,7 +129,7 @@
 		return NULL;
 
 	tmp.name = name;
-	cur = (account_data_t *)avl_search(&accounts.index, (avl *) &tmp);
+	cur = (account_data_t *)avl_search(&accounts.index, (avl_t *) &tmp);
 	return cur;
 }
 
@@ -146,7 +146,7 @@
 	if (debug)
 		my_printf("Deleting %s", name);
 	cur = NULL;
-	tmp2 = (account_data_t *)avl_remove(&accounts.index, (avl *) &tmp1);
+	tmp2 = (account_data_t *)avl_remove(&accounts.index, (avl_t *) &tmp1);
 	if (tmp2) {
 		accounts.count--;
 		if (strcmp(tmp2->name, name) != 0) {

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/account.h -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/account.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/avl.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/avl.c Changed

@@ -28,8 +28,8 @@
 
 /* Search |tree| for an item matching |item|, and return it if found.
      Otherwise return |NULL|. */
-avl *avl_search(avl_tree *tree, avl *item) {
-    avl *p;
+avl_t *avl_search(const avl_tree_t *tree, avl_t *item) {
+    avl_t *p;
 
     // assert (tree != NULL && item != NULL);
 
@@ -51,11 +51,11 @@
      If a duplicate item is found in the tree,
      returns a pointer to the duplicate without inserting |item|.
  */
-avl *avl_insert(avl_tree *tree, avl *item) {
-    avl *y, *z; /* Top node to update balance factor, and parent. */
-    avl *p, *q; /* Iterator, and parent. */
-    avl *n;     /* Newly inserted node. */
-    avl *w;     /* New root of rebalanced subtree. */
+avl_t *avl_insert(avl_tree_t *tree, avl_t *item) {
+    avl_t *y, *z; /* Top node to update balance factor, and parent. */
+    avl_t *p, *q; /* Iterator, and parent. */
+    avl_t *n;     /* Newly inserted node. */
+    avl_t *w;     /* New root of rebalanced subtree. */
     unsigned char dir; /* Direction to descend. */
 
     unsigned char daAVL_MAX_HEIGHT; /* Cached comparison results. */
@@ -63,7 +63,7 @@
 
     // assert(tree != NULL && item != NULL);
 
-    z = (avl *) &tree->root;
+    z = (avl_t *) &tree->root;
     y = tree->root;
     dir = 0;
     for (q = z, p = y; p != NULL; q = p, p = p->avl_linkdir) {
@@ -90,7 +90,7 @@
             p->avl_balance++;
 
     if (y->avl_balance == -2) {
-        avl *x = y->avl_link0;
+        avl_t *x = y->avl_link0;
         if (x->avl_balance == -1) {
             w = x;
             y->avl_link0 = x->avl_link1;
@@ -114,7 +114,7 @@
         }
     }
     else if (y->avl_balance == +2) {
-        avl *x = y->avl_link1;
+        avl_t *x = y->avl_link1;
         if (x->avl_balance == +1) {
             w = x;
             y->avl_link1 = x->avl_link0;
@@ -147,19 +147,19 @@
 
 /* Deletes from |tree| and returns an item matching |item|.
      Returns a null pointer if no matching item found. */
-avl *avl_remove(avl_tree *tree, avl *item) {
+avl_t *avl_remove(avl_tree_t *tree, avl_t *item) {
     /* Stack of nodes. */
-    avl *paAVL_MAX_HEIGHT; /* Nodes. */
+    avl_t *paAVL_MAX_HEIGHT; /* Nodes. */
     unsigned char daAVL_MAX_HEIGHT;    /* |avl_link| indexes. */
     int k;                               /* Stack pointer. */
 
-    avl *p;   /* Traverses tree to find node to delete. */
+    avl_t *p;   /* Traverses tree to find node to delete. */
     int cmp;              /* Result of comparison between |item| and |p|. */
 
     // assert (tree != NULL && item != NULL);
 
     k = 0;
-    p = (avl *) &tree->root;
+    p = (avl_t *) &tree->root;
     for(cmp = -1; cmp != 0; cmp = tree->compar(item, p)) {
         unsigned char dir = (unsigned char)(cmp > 0);
 
@@ -175,7 +175,7 @@
     if (p->avl_link1 == NULL)
         pak - 1->avl_linkdak - 1 = p->avl_link0;
     else {
-        avl *r = p->avl_link1;
+        avl_t *r = p->avl_link1;
         if (r->avl_link0 == NULL) {
             r->avl_link0 = p->avl_link0;
             r->avl_balance = p->avl_balance;
@@ -184,7 +184,7 @@
             pak++ = r;
         }
         else {
-            avl *s;
+            avl_t *s;
             int j = k++;
 
             for (;;) {
@@ -209,15 +209,15 @@
 
     // assert (k > 0);
     while (--k > 0) {
-        avl *y = pak;
+        avl_t *y = pak;
 
         if (dak == 0) {
             y->avl_balance++;
             if (y->avl_balance == +1) break;
             else if (y->avl_balance == +2) {
-                avl *x = y->avl_link1;
+                avl_t *x = y->avl_link1;
                 if (x->avl_balance == -1) {
-                    avl *w;
+                    avl_t *w;
                     // assert (x->avl_balance == -1);
                     w = x->avl_link0;
                     x->avl_link0 = w->avl_link1;
@@ -251,9 +251,9 @@
             y->avl_balance--;
             if (y->avl_balance == -1) break;
             else if (y->avl_balance == -2) {
-                avl *x = y->avl_link0;
+                avl_t *x = y->avl_link0;
                 if (x->avl_balance == +1) {
-                    avl *w;
+                    avl_t *w;
                     // assert (x->avl_balance == +1);
                     w = x->avl_link1;
                     x->avl_link1 = w->avl_link0;
@@ -295,7 +295,7 @@
 // ---------------------------
 // traversing
 
-int avl_walker(avl *node, int (*callback)(void *entry, void *data), void *data) {
+int avl_walker(avl_t *node, int (*callback)(void *entry, void *data), void *data) {
     int total = 0, ret = 0;
 
     if(node->avl_link0) {
@@ -317,7 +317,7 @@
     return total;
 }
 
-int avl_traverse(avl_tree *t, int (*callback)(void *entry, void *data),
+int avl_traverse(const avl_tree_t *t, int (*callback)(void *entry, void *data),
                  void *data) {
     if(t->root)
         return avl_walker(t->root, callback, data);
@@ -325,7 +325,7 @@
         return 0;
 }
 
-void avl_init(avl_tree *t, int (*compar)(void *a, void *b)) {
+void avl_init(avl_tree_t *t, int (*compar)(void *a, void *b)) {
     t->root = NULL;
     t->compar = compar;
 }
@@ -335,7 +335,7 @@
 
 // ---------------------------
 
-avl *avl_first(avl_iterator *i, avl_tree *t)
+avl_t *avl_first(avl_iterator *i, avl_tree_t *t)
 {
 	if (t->root == NULL || i == NULL)
 		return NULL;
@@ -344,7 +344,7 @@
 	i->height = 0;
 
 	// follow the leftmost node to its bottom
-	avl *node = t->root;
+	avl_t *node = t->root;
 	while (node->avl_link0) {
 		i->stacki->height = node;
 		i->height++;
@@ -355,12 +355,12 @@
 	return node;
 }
 
-avl *avl_next(avl_iterator *i)
+avl_t *avl_next(avl_iterator *i)
 {
 	if (i == NULL || i->tree == NULL)
 		return NULL;
 
-	avl *node = i->current;
+	avl_t *node = i->current;
 	if (node == NULL)
 		return avl_first(i, i->tree);
 	else if (node->avl_link1) {
@@ -374,7 +374,7 @@
 			node = node->avl_link0;
 		}
 	} else {
-		avl *tmp;
+		avl_t *tmp;
 
 		do {
 			if (i->height == 0) {
@@ -392,7 +392,7 @@
 	return node;
 }

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/avl.h -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/avl.h Changed

@@ -14,19 +14,19 @@
 typedef struct avl {
     struct avl *avl_link2;  /* Subtrees - 0 left, 1 right */
     signed char avl_balance;  /* Balance factor. */
-} avl;
+} avl_t;
 
 /* An AVL tree */
 typedef struct avl_tree {
-    avl *root;
+    avl_t *root;
     int (*compar)(void *a, void *b);
-} avl_tree;
+} avl_tree_t;
 
 /* Iterator state struct */
 typedef struct avl_iterator {
-	avl_tree *tree;
-	avl *current;
-	avl *stackAVL_MAX_HEIGHT;
+	avl_tree_t *tree;
+	avl_t *current;
+	avl_t *stackAVL_MAX_HEIGHT;
 	unsigned height;
 } avl_iterator;
 
@@ -39,40 +39,40 @@
  * a is linked directly to the tree, so it has to
  * be properly allocated by the caller.
  */
-avl *avl_insert(avl_tree *t, avl *a) NEVERNULL WARNUNUSED;
+avl_t *avl_insert(avl_tree_t *t, avl_t *a) NEVERNULL WARNUNUSED;
 
 /* Remove an element a from the AVL tree t
  * returns a pointer to the removed element
  * or NULL if an element equal to a is not found
  * (equal as returned by t->compar())
  */
-avl *avl_remove(avl_tree *t, avl *a) WARNUNUSED;
+avl_t *avl_remove(avl_tree_t *t, avl_t *a) WARNUNUSED;
 
 /* Find the element into the tree that equal to a
  * (equal as returned by t->compar())
  * returns NULL is no element is equal to a
  */
-avl *avl_search(avl_tree *t, avl *a);
+avl_t *avl_search(const avl_tree_t *t, avl_t *a);
 
-/* Initialize the avl_tree
+/* Initialize the avl_tree_t
  */
-void avl_init(avl_tree *t, int (*compar)(void *a, void *b));
+void avl_init(avl_tree_t *t, int (*compar)(void *a, void *b));
 
 /* Walk the tree and call callback at each node
  */
-int avl_traverse(avl_tree *t, int (*callback)(void *entry, void *data),
+int avl_traverse(const avl_tree_t *t, int (*callback)(void *entry, void *data),
 		 void *data);
 
 /* Walk the tree down to the first node and return it
  */
-avl *avl_first(avl_iterator *i, avl_tree *t);
+avl_t *avl_first(avl_iterator *i, avl_tree_t *t);
 
 /* Walk the tree to the next logical node and return it
  */
-avl *avl_next(avl_iterator *i);
+avl_t *avl_next(avl_iterator *i);
 
 /* Given two trees, see if any in needle are contained in haystack
  */
-int avl_intersection(avl_tree *needle, avl_tree *haystack);
+int avl_intersection(const avl_tree_t *needle, avl_tree_t *haystack);
 
 #endif /* avl.h */

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/ids_config.h -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/ids_config.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/origin.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/origin.c Changed

@@ -13,7 +13,7 @@
 
 // This holds info about all sessions
 struct origin_avl{
-	avl_tree index;
+	avl_tree_t index;
 	unsigned int count;
 };
 
@@ -79,10 +79,10 @@
 
 static void destroy_origin(void)
 {
-	avl *cur = origins.index.root;
+	avl_t *cur = origins.index.root;
 
 	origin_data_t *o = (origin_data_t *)avl_remove(&origins.index, cur);
-	if ((avl *)o != cur)
+	if ((avl_t *)o != cur)
 		my_printf("origin: removal of invalid node");
 
 	// Now free any data pointed to by cur
@@ -105,7 +105,7 @@
 		my_printf("Adding origin %u", o->address);
 
 	cur = NULL;
-	tmp = (origin_data_t *)avl_insert(&origins.index, (avl *)(o));
+	tmp = (origin_data_t *)avl_insert(&origins.index, (avl_t *)(o));
 	if (tmp) {
 		if (tmp != o) {
 			if (debug)
@@ -125,7 +125,7 @@
 	origin_data_t tmp;
 
 	tmp.address = addr;
-	cur = (origin_data_t *)avl_search(&origins.index, (avl *) &tmp);
+	cur = (origin_data_t *)avl_search(&origins.index, (avl_t *) &tmp);
 	return cur;
 }
 
@@ -142,7 +142,7 @@
 	if (debug)
 		my_printf("Deleting %u", addr);
 	cur = NULL;
-	tmp2 = (origin_data_t *)avl_remove(&origins.index, (avl *) &tmp1);
+	tmp2 = (origin_data_t *)avl_remove(&origins.index, (avl_t *) &tmp1);
 	if (tmp2) {
 		origins.count--;
 		if (tmp2->address != addr) {

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/origin.h -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/origin.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/rules/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/rules/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/session.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/session.c Changed

@@ -17,7 +17,7 @@
 
 // This holds info about all sessions
 struct session_avl{
-	avl_tree index;
+	avl_tree_t index;
 	unsigned int count;
 };
 
@@ -76,10 +76,10 @@
 
 static void destroy_session(void)
 {
-	avl *cur = sessions.index.root;
+	avl_t *cur = sessions.index.root;
 
 	session_data_t *tmp =(session_data_t *)avl_remove(&sessions.index, cur);
-	if ((avl *)tmp != cur)
+	if ((avl_t *)tmp != cur)
 		my_printf("session: removal of invalid node");
 	free_session(tmp);
 	cur = NULL;
@@ -113,7 +113,7 @@
 		my_printf("Adding session %u, %p", s->session, s);
 
 	cur = NULL;
-	tmp = (session_data_t *)avl_insert(&sessions.index, (avl *)(s));
+	tmp = (session_data_t *)avl_insert(&sessions.index, (avl_t *)(s));
 	if (tmp) {
 		if (tmp != s) {
 			if (debug)
@@ -144,7 +144,7 @@
 	session_data_t tmp;
 
 	tmp.session = s;
-	cur = (session_data_t *)avl_search(&sessions.index, (avl *) &tmp);
+	cur = (session_data_t *)avl_search(&sessions.index, (avl_t *) &tmp);
 	return cur;
 }
 
@@ -161,7 +161,7 @@
 	if (debug)
 		my_printf("Deleting %u", s);
 	cur = NULL;
-	tmp2 = (session_data_t *)avl_remove(&sessions.index, (avl *) &tmp1);
+	tmp2 = (session_data_t *)avl_remove(&sessions.index, (avl_t *) &tmp1);
 	if (tmp2) {
 		sessions.count--;
 		if (tmp2->session != s) {

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/ids/session.h -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/ids/session.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/remote/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/remote/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/statsd/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/statsd/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/statsd/audisp-statsd.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/statsd/audisp-statsd.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/syslog/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/syslog/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/syslog/audisp-syslog.8 -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/syslog/audisp-syslog.8 Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/syslog/audisp-syslog.c -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/syslog/audisp-syslog.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/audisp/plugins/zos-remote/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/audisp/plugins/zos-remote/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/audit.spec -> _service:tar_scm:audit-3.1.1.tar.gz/audit.spec Changed

@@ -1,9 +1,8 @@
-
 Summary: User space tools for kernel auditing
 Name: audit
-Version: 3.0.9
+Version: 3.1.1
 Release: 1%{dist}
-License: GPLv2+
+License: GPL-2.0-or-later AND LGPL-2.0-or-later
 Group: System Environment/Daemons
 URL: http://people.redhat.com/sgrubb/audit/
 Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
@@ -93,8 +92,8 @@
 %configure --sbindir=/sbin --libdir=/%{_lib} --with-python=no \
 	   --with-python3=yes \
 	   --enable-gssapi-krb5=yes --with-arm --with-aarch64 \
-	   --with-libcap-ng=yes --enable-zos-remote \
-	   --enable-systemd
+	   --with-libcap-ng=yes --without-golang --enable-zos-remote \
+	   --enable-systemd --enable-experimental --with-io_uring
 
 make CFLAGS="%{optflags}" %{?_smp_mflags}
 
@@ -130,7 +129,7 @@
 touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz
 
 %check
-make check
+make %{?_smp_mflags} check
 # Get rid of make files so that they don't get packaged.
 rm -f rules/Makefile*
 
@@ -164,7 +163,6 @@
 %{_mandir}/man5/libaudit.conf.5.gz
 
 %files libs-devel
-%defattr(-,root,root,-)
 %doc contrib/plugin
 %{_libdir}/libaudit.so
 %{_libdir}/libauparse.so
@@ -194,7 +192,6 @@
 %license COPYING
 %doc README ChangeLog rules init.d/auditd.cron
 %attr(755,root,root) %{_datadir}/%{name}
-%attr(644,root,root) %{_datadir}/%{name}/sample-rules/*
 %attr(644,root,root) %{_mandir}/man8/auditctl.8.gz
 %attr(644,root,root) %{_mandir}/man8/auditd.8.gz
 %attr(644,root,root) %{_mandir}/man8/aureport.8.gz
@@ -214,7 +211,7 @@
 %attr(755,root,root) /sbin/ausearch
 %attr(755,root,root) /sbin/aureport
 %attr(750,root,root) /sbin/autrace
-%attr(750,root,root) /sbin/augenrules
+%attr(755,root,root) /sbin/augenrules
 %attr(755,root,root) %{_bindir}/aulast
 %attr(755,root,root) %{_bindir}/aulastlog
 %attr(755,root,root) %{_bindir}/ausyscall
@@ -247,17 +244,26 @@
 %config(noreplace) %attr(640,root,root) /etc/audit/audisp-remote.conf
 %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-remote.conf
 %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/syslog.conf
+%config(noreplace) %attr(640,root,root) /etc/audit/audisp-statsd.conf
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-statsd.conf
+%config(noreplace) %attr(640,root,root) /etc/audit/ids.conf
+%config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/audisp-ids.conf
+%attr(644,root,root) %{_datadir}/%{name}/ids-rules/*
 %attr(750,root,root) /sbin/audisp-remote
 %attr(750,root,root) /sbin/audisp-syslog
+%attr(750,root,root) /sbin/audisp-af_unix
+%attr(750,root,root) /sbin/audisp-ids
+%attr(750,root,root) /sbin/audisp-statsd
 %attr(700,root,root) %dir %{_var}/spool/audit
 %attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz
 %attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz
 %attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz
 %attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz
 %attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz
+%attr(644,root,root) %{_mandir}/man8/audisp-af_unix.8.gz
 
 
 %changelog
-* Mon Aug 29 2022 Steve Grubb <sgrubb@redhat.com> 3.0.9-1
+* Thu Feb 09 2023 Steve Grubb <sgrubb@redhat.com> 3.1i.-1
 - New upstream release

_service:tar_scm:audit-3.0.9.tar.gz/auparse/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/auparse/auditd-config.c -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/auditd-config.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/auparse/auparse-defs.h -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/auparse-defs.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/auparse/ellist.c -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/ellist.c Changed

@@ -1,7 +1,7 @@
 /*
 * ellist.c - Minimal linked list library
-* Copyright (c) 2006-08,2014,2016-17 Red Hat Inc., Durham, North Carolina.
-* All Rights Reserved. 
+* Copyright (c) 2006-08,2014,2016-17,2023 Red Hat Inc.
+* All Rights Reserved.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
@@ -122,6 +122,7 @@
 	memcpy(r->nv.record, r->record, len);
 	r->nv.end = r->nv.record + len;
 	ptr = audit_strsplit_r(buf, &saved);
+	// If no fields we have fuzzer induced problems, leave
 	if (ptr == NULL) {
 		free(buf);
 		r->nv.record = NULL;
@@ -130,6 +131,7 @@
 
 	do {	// If there's an '=' sign, its a keeper
 		nvnode n;
+
 		char *val = strchr(ptr, '=');
 		if (val) {
 			int len;
@@ -245,6 +247,8 @@
 			else if (r->nv.cnt == (1 + offset) &&
 					strcmp(n.name, "type") == 0) {
 				r->type = audit_name_to_msg_type(n.val);
+				if (r->type == AUDIT_URINGOP)
+					r->machine = MACH_IO_URING;
 				// This has to account for seccomp records
 			} else if ((r->nv.cnt == (2 + offset) ||
 					r->nv.cnt == (11 + offset)) &&
@@ -263,6 +267,12 @@
 				r->syscall = strtoul(n.val, NULL, 10);
 				if (errno)
 					r->syscall = -1;
+			} else if (r->nv.cnt == (2 + offset) &&
+				   strcmp(n.name, "uring_op") == 0) {
+				errno = 0;
+				r->syscall = strtoul(n.val, NULL, 10);
+				if (errno)
+					r->syscall = -1;
 			} else if (r->nv.cnt == (6 + offset) &&
 					strcmp(n.name, "a0") == 0){
 				errno = 0;
@@ -276,7 +286,8 @@
 				if (errno)
 					r->a1 = -1LL;
 			} else if (r->type == AUDIT_CWD) {
-				if (strcmp(n.name, "cwd") == 0)
+				// most common fuzzing hit: duplicate cwds
+				if (strcmp(n.name, "cwd") == 0 && !r->cwd)
 					r->cwd = strdup(n.val);
 			}
 		} else if (r->type == AUDIT_AVC || r->type == AUDIT_USER_AVC) {
@@ -323,6 +334,7 @@
 				}
 			} else
 				continue;
+
 			n.val = ptr;
 			nvlist_append(&r->nv, &n);
 		}
@@ -334,6 +346,7 @@
 		r->nv.record = NULL;
 		r->nv.end = NULL;
 		free((void *)r->cwd);
+		r->cwd = NULL;
 	}
 
 	r->nv.cur = 0;	// reset to beginning
@@ -362,7 +375,7 @@
 	r->a1 = 0LL;
 	r->machine = -1;
 	r->syscall = -1;
-	r->item = l->cnt; 
+	r->item = l->cnt;
 	r->list_idx = list_idx;
 	r->line_number = line_number;
 	r->next = NULL;
@@ -382,6 +395,9 @@
 
 	// Then parse the record up into nvlist
 	rc = parse_up_record(r);
+	if (r->nv.cnt == 0) // This is fuzzer induced, return an error.
+		rc = -1;
+
 	if (r->cwd) {
 		// Should never be 2 cwd records unless log is corrupted
 		free((void *)l->cwd);

_service:tar_scm:audit-3.0.9.tar.gz/auparse/interpret.c -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/interpret.c Changed

@@ -1,6 +1,6 @@
 /*
 * interpret.c - Lookup values to something more readable
-* Copyright (c) 2007-09,2011-16,2018-21 Red Hat Inc.
+* Copyright (c) 2007-09,2011-16,2018-21,2023 Red Hat Inc.
 * All Rights Reserved.
 *
 * This library is free software; you can redistribute it and/or
@@ -918,7 +918,7 @@
 			if (dest > rpath + 1)
 				while ((--dest)-1 != '/');
 		} else {
-			if (dest-1 != '/')
+			if (dest != working && dest-1 != '/')
 				*dest++ = '/';
 
 			// If it will overflow, chop it at last component
@@ -939,23 +939,29 @@
 	if (id->cwd) {
 		char *str1 = NULL, *str2, *str3 = NULL, *out = NULL;
 		str2 = print_escaped(id->val);
+
 		if (!str2)
 			goto err_out;
 		if (*str2 != '/') {
+			// Glue the cwd and path together
 			str1 = print_escaped(id->cwd);
 			if (!str1)
 				goto err_out;
 			if (asprintf(&str3, "%s/%s", str1, str2) < 0)
 				goto err_out;
 		} else {
-			// Check in case /home/../etc/passwd
-			if (strstr(str2, "..") == NULL)
-				return str2;
-
+			// Normal looking string
 			str3 = str2;
 			str2 = NULL;
-			str1 = NULL;
 		}
+
+		// Check in case /home/../etc/passwd
+		if (strstr(str3, "..") == NULL) {
+			free(str1);
+			free(str2);
+			return str3; // Nope, just return the string
+		}
+
 		out = path_norm(str3);
 		if (!out) { // If there's an error, just return the original
 			free(str1);
@@ -1490,15 +1496,15 @@
 		return strdup(val);
 }
 
-static const char *print_open_flags(const char *val)
+static const char *print_open_flags(const char *val, int base)
 {
 	size_t i;
-	unsigned int flags;
+	unsigned long flags;
 	int cnt = 0;
 	char *out, bufsizeof(open_flag_strings)+OPEN_FLAG_NUM_ENTRIES+1;
 
 	errno = 0;
-	flags = strtoul(val, NULL, 16);
+	flags = strtoul(val, NULL, base);
         if (errno) {
 		if (asprintf(&out, "conversion error(%s)", val) < 0)
 			out = NULL;
@@ -2372,6 +2378,60 @@
 	return strdup(buf);
 }
 
+static const char *print_trust(const char *val)
+{
+	const char *out;
+
+	if (strcmp(val, "0") == 0)
+		out = strdup("no");
+	else if (strcmp(val, "1") == 0)
+		out = strdup("yes");
+	else
+		out = strdup("unknown");
+
+	return out;
+}
+
+// fan_type always preceeds fan_info
+static int last_type = 2;
+static const char *print_fan_type(const char *val)
+{
+	const char *out;
+
+	if (strcmp(val, "0") == 0) {
+		out = strdup("none");
+		last_type = 0;
+	} else if (strcmp(val, "1") == 0) {
+		out = strdup("rule_info");
+		last_type = 1;
+	} else {
+		out = strdup("unknown");
+		last_type = 2;
+	}
+
+	return out;
+}
+
+static const char *print_fan_info(const char *val)
+{
+	char *out;
+	if (last_type == 1) {
+		errno = 0;
+		unsigned long info = strtoul(val, NULL, 16);
+		if (errno) {
+			if (asprintf(&out, "conversion error(%s)", val) < 0)
+				out = NULL;
+			return out;
+		} else {
+			if (asprintf(&out, "%lu", info) < 0)
+				out = NULL;
+			return out;
+		}
+	} else
+		out = strdup(val);
+	return out;
+}
+
 static const char *print_a0(const char *val, const idata *id)
 {
 	char *out;
@@ -2504,10 +2564,10 @@
 			else if (strcmp(sys, "mknod") == 0)
 				return print_mode(val, 16);
 			else if (strcmp(sys, "mq_open") == 0)
-				return print_open_flags(val);
+				return print_open_flags(val, 16);
 		}
 		else if (strcmp(sys, "open") == 0)
-			return print_open_flags(val);
+			return print_open_flags(val, 16);
 		else if (strcmp(sys, "access") == 0)
 			return print_access(val);
 		else if (strcmp(sys, "epoll_ctl") == 0)
@@ -2581,11 +2641,11 @@
 				goto normal;
 		} else if (*sys == 'o') {
 			if (strcmp(sys, "openat") == 0)
-				return print_open_flags(val);
+				return print_open_flags(val, 16);
 			if ((strcmp(sys, "open") == 0) && (id->a1 & O_CREAT))
 				return print_mode_short(val, 16);
 			if (strcmp(sys, "open_by_handle_at") == 0)
-			    return print_open_flags(val);
+			    return print_open_flags(val, 16);
 		} else if (*sys == 'f') {
 			if (strcmp(sys, "fchmodat") == 0)
 				return print_mode_short(val, 16);
@@ -3256,8 +3316,8 @@
 		case AUPARSE_TYPE_SECCOMP:
 			out = print_seccomp_code(id->val);
 			break;
-		case AUPARSE_TYPE_OFLAG:
-			out = print_open_flags(id->val);
+		case AUPARSE_TYPE_OFLAG: // AUDIT_OPENAT2,MQ_OPEN
+			out = print_open_flags(id->val, 0);
 			break;
 		case AUPARSE_TYPE_MMAP:
 			out = print_mmap(id->val);
@@ -3286,6 +3346,15 @@
 		case AUPARSE_TYPE_RESOLVE:
 			out = print_openat2_resolve(id->val);
 			break;
+		case AUPARSE_TYPE_TRUST:
+			out = print_trust(id->val);
+			break;
+		case AUPARSE_TYPE_FAN_TYPE:
+			out = print_fan_type(id->val);
+			break;
+		case AUPARSE_TYPE_FAN_INFO:
+			out = print_fan_info(id->val);
+			break;
 		case AUPARSE_TYPE_MAC_LABEL:
 		case AUPARSE_TYPE_UNCLASSIFIED:
 		default:
@@ -3338,8 +3407,23 @@
 				// Its here just in the off chance someone
 				// actually put a control character in a key.
 				char *dest = malloc(len + 1 + (3*cnt));
-				if (dest)
-					key_escape(out, dest, escape_mode);
+				if (dest) {
+					// Because need_escaping was called
+					// terminated, we need to do the same
+					// incase there's a Ctl-A in the key.
+					// This is likely fuzzer induced.
+					char tmp;
+					str = strchr(out, AUDIT_KEY_SEPARATOR);
+					if (str) {

_service:tar_scm:audit-3.0.9.tar.gz/auparse/normalize.c -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/normalize.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/auparse/normalize_record_map.h -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/normalize_record_map.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/auparse/nvlist.c -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/nvlist.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/auparse/test/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/test/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/auparse/typetab.h -> _service:tar_scm:audit-3.1.1.tar.gz/auparse/typetab.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/golang/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/golang/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/python/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/python/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/python/auparse_python.c -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/python/auparse_python.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/python/python2/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/python/python2/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/python/python3/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/python/python3/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/swig/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/swig/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/swig/python/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/swig/python/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/swig/python/audit.py -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/swig/python/audit.py Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/swig/python3/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/swig/python3/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/bindings/swig/python3/audit.py -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/swig/python3/audit.py Changed

@@ -620,6 +620,7 @@
 MACH_ARM = _audit.MACH_ARM
 MACH_AARCH64 = _audit.MACH_AARCH64
 MACH_PPC64LE = _audit.MACH_PPC64LE
+MACH_IO_URING = _audit.MACH_IO_URING
 FAIL_IGNORE = _audit.FAIL_IGNORE
 FAIL_LOG = _audit.FAIL_LOG
 FAIL_TERMINATE = _audit.FAIL_TERMINATE
@@ -673,6 +674,12 @@
 def audit_syscall_to_name(sc: "int", machine: "int") -> "char const *":
     return _audit.audit_syscall_to_name(sc, machine)
 
+def audit_uringop_to_name(uringop: "int") -> "char const *":
+    return _audit.audit_uringop_to_name(uringop)
+
+def audit_name_to_uringop(uringop: "char const *") -> "int":
+    return _audit.audit_name_to_uringop(uringop)
+
 def audit_name_to_flag(flag: "char const *") -> "int":
     return _audit.audit_name_to_flag(flag)
 
@@ -837,6 +844,9 @@
 def audit_rule_syscallbyname_data(rule: "audit_rule_data", scall: "char const *") -> "int":
     return _audit.audit_rule_syscallbyname_data(rule, scall)
 
+def audit_rule_io_uringbyname_data(rule: "audit_rule_data", scall: "char const *") -> "int":
+    return _audit.audit_rule_io_uringbyname_data(rule, scall)
+
 def audit_rule_fieldpair_data(rulep: "struct audit_rule_data **", pair: "char const *", flags: "int") -> "int":
     return _audit.audit_rule_fieldpair_data(rulep, pair, flags)

_service:tar_scm:audit-3.0.9.tar.gz/bindings/swig/src/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/bindings/swig/src/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/common/Makefile.am -> _service:tar_scm:audit-3.1.1.tar.gz/common/Makefile.am Changed

_service:tar_scm:audit-3.0.9.tar.gz/common/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/common/Makefile.in Changed

@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 # Makefile.am-- 
-# Copyright 2018 Red Hat Inc., Durham, North Carolina.
+# Copyright 2018-2023 Red Hat Inc.
 # All Rights Reserved.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -209,6 +209,7 @@
 BUILD_EXEEXT = @BUILD_EXEEXT@
 BUILD_OBJEXT = @BUILD_OBJEXT@
 CAPNG_LDADD = @CAPNG_LDADD@
+CAPNG_PKG = @CAPNG_PKG@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CC_FOR_BUILD = @CC_FOR_BUILD@
@@ -289,6 +290,7 @@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
+SWIG = @SWIG@
 VERSION = @VERSION@
 WFLAGS = @WFLAGS@
 abs_builddir = @abs_builddir@
@@ -359,7 +361,8 @@
 top_srcdir = @top_srcdir@
 use_python3 = @use_python3@
 CONFIG_CLEAN_FILES = *.rej *.orig
-AM_CPPFLAGS = -D_GNU_SOURCE -fPIC -DPIC -I${top_srcdir} -I${top_srcdir}/lib
+AM_CFLAGS = -fPIC -DPIC -D_GNU_SOURCE -g
+AM_CPPFLAGS = -I${top_srcdir} -I${top_srcdir}/lib
 noinst_HEADERS = common.h
 libaucommon_la_DEPENDENCIES = ../config.h
 libaucommon_la_SOURCES = audit-fgets.c strsplit.c

_service:tar_scm:audit-3.0.9.tar.gz/common/audit-fgets.c -> _service:tar_scm:audit-3.1.1.tar.gz/common/audit-fgets.c Changed

@@ -1,23 +1,23 @@
-/* audit-fgets.c --
- * Copyright 2011 Red Hat Inc., Durham, North Carolina.
+/* audit-fgets.c -- a replacement for glibc's fgets
+ * Copyright 2018,2022 Red Hat Inc.
  * All Rights Reserved.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
  *
- * This program is distributed in the hope that it will be useful,
+ * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  * Authors:
- *   Steve Grubb <sgrubb@redhat.com>
+ *      Steve Grubb <sgrubb@redhat.com>
  */
 
 #include "config.h"
@@ -38,6 +38,15 @@
 	return eof;
 }
 
+/* This function dumps any accumulated text. This is to remove dangling text
+ * that never got consumed for the intended purpose. */
+void audit_fgets_clear(void)
+{
+	buffer0 = 0;
+	current = buffer;
+	eof = 0;
+}
+
 /* Function to check if we have more data stored
  * and ready to process. If we have a newline or enough
  * bytes we return 1 for success. Otherwise 0 meaning that

_service:tar_scm:audit-3.0.9.tar.gz/common/common.h -> _service:tar_scm:audit-3.1.1.tar.gz/common/common.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/config.h.in -> _service:tar_scm:audit-3.1.1.tar.gz/config.h.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/configure -> _service:tar_scm:audit-3.1.1.tar.gz/configure Changed

@@ -1,7 +1,7 @@
 #! /bin/sh
 # From configure.ac Revision: 1.3 .
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for audit 3.0.9.
+# Generated by GNU Autoconf 2.71 for audit 3.1.1.
 #
 #
 # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation,
@@ -619,8 +619,8 @@
 # Identity of this package.
 PACKAGE_NAME='audit'
 PACKAGE_TARNAME='audit'
-PACKAGE_VERSION='3.0.9'
-PACKAGE_STRING='audit 3.0.9'
+PACKAGE_VERSION='3.1.1'
+PACKAGE_STRING='audit 3.1.1'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -662,6 +662,7 @@
 LIBOBJS
 LIBWRAP_LIBS
 DEBUG
+CAPNG_PKG
 CAPNG_LDADD
 USE_AARCH64_FALSE
 USE_AARCH64_TRUE
@@ -685,6 +686,7 @@
 HAVE_GOLANG_TRUE
 GOROOT
 GOLANG
+SWIG
 USE_PYTHON3_FALSE
 USE_PYTHON3_TRUE
 py3execdir
@@ -870,6 +872,7 @@
 with_aarch64
 with_apparmor
 with_libwrap
+with_io_uring
 with_libcap_ng
 '
       ac_precious_vars='build_alias
@@ -1431,7 +1434,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures audit 3.0.9 to adapt to many kinds of systems.
+\`configure' configures audit 3.1.1 to adapt to many kinds of systems.
 
 Usage: $0 OPTION... VAR=VALUE...
 
@@ -1503,7 +1506,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of audit 3.0.9:";;
+     short | recursive ) echo "Configuration of audit 3.1.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1553,6 +1556,7 @@
   --with-aarch64          enable Aarch64 processor support
   --with-apparmor         enable AppArmor events
   --with-libwrap=PATH   Compile in libwrap (tcp_wrappers) support.
+  --with-io_uring         enable io_uring support
   --with-libcap-ng=auto/yes/no  Add Libcap-ng support default=auto
 
 Some influential environment variables:
@@ -1635,7 +1639,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-audit configure 3.0.9
+audit configure 3.1.1
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2292,7 +2296,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by audit $as_me 3.0.9, which was
+It was created by audit $as_me 3.1.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3683,7 +3687,7 @@
 
 # Define the identity of the package.
  PACKAGE='audit'
- VERSION='3.0.9'
+ VERSION='3.1.1'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -15675,83 +15679,6 @@
 
 echo .
 echo Checking for header files
-# Autoupdate added the next two lines to ensure that your configure
-# script's behavior did not change.  They are probably safe to remove.
-
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
-printf %s "checking for egrep... " >&6; }
-if test ${ac_cv_path_EGREP+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-  if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
-   then ac_cv_path_EGREP="$GREP -E"
-   else
-     if test -z "$EGREP"; then
-  ac_path_EGREP_found=false
-  # Loop through the user's path and test for each of PROGNAME-LIST
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
-do
-  IFS=$as_save_IFS
-  case $as_dir in #(((
-    '') as_dir=./ ;;
-    */) ;;
-    *) as_dir=$as_dir/ ;;
-  esac
-    for ac_prog in egrep
-   do
-    for ac_exec_ext in '' $ac_executable_extensions; do
-      ac_path_EGREP="$as_dir$ac_prog$ac_exec_ext"
-      as_fn_executable_p "$ac_path_EGREP" || continue
-# Check for GNU ac_path_EGREP and select it if it is found.
-  # Check for GNU $ac_path_EGREP
-case `"$ac_path_EGREP" --version 2>&1` in
-*GNU*)
-  ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
-*)
-  ac_count=0
-  printf %s 0123456789 >"conftest.in"
-  while :
-  do
-    cat "conftest.in" "conftest.in" >"conftest.tmp"
-    mv "conftest.tmp" "conftest.in"
-    cp "conftest.in" "conftest.nl"
-    printf "%s\n" 'EGREP' >> "conftest.nl"
-    "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
-    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
-    as_fn_arith $ac_count + 1 && ac_count=$as_val
-    if test $ac_count -gt ${ac_path_EGREP_max-0}; then
-      # Best one so far, save it but keep looking for a better one
-      ac_cv_path_EGREP="$ac_path_EGREP"
-      ac_path_EGREP_max=$ac_count
-    fi
-    # 10*(2^10) chars as input seems more than enough
-    test $ac_count -gt 10 && break
-  done
-  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
-esac
-
-      $ac_path_EGREP_found && break 3
-    done
-  done
-  done
-IFS=$as_save_IFS
-  if test -z "$ac_cv_path_EGREP"; then
-    as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
-  fi
-else
-  ac_cv_path_EGREP=$EGREP
-fi
-
-   fi
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
-printf "%s\n" "$ac_cv_path_EGREP" >&6; }
- EGREP="$ac_cv_path_EGREP"
-
-
-
 
 
 # Obsolete code to be removed.
@@ -16539,8 +16466,8 @@
 	if test "x$use_python" = xyes ; then
 		as_fn_error $? "Python explicitly requested and python headers were not found" "$LINENO" 5
 	else
-		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: \"Python headers not found - python bindings will not be made\"" >&5
-printf "%s\n" "$as_me: WARNING: \"Python headers not found - python bindings will not be made\"" >&2;}
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Python headers not found - python bindings will not be made" >&5
+printf "%s\n" "$as_me: WARNING: Python headers not found - python bindings will not be made" >&2;}
 	fi
 fi
 fi
@@ -16708,6 +16635,56 @@
 fi
 
 
+if test "x$use_python" = "xyes" || test "x$use_python3" = "xyes" ; then
+	# Extract the first word of "swig", so it can be a program name with args.
+set dummy swig; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5

_service:tar_scm:audit-3.0.9.tar.gz/configure.ac -> _service:tar_scm:audit-3.1.1.tar.gz/configure.ac Changed

@@ -1,7 +1,7 @@
 dnl
 define(AC_INIT_NOTICE,
 ### Generated automatically using autoconf version AC_ACVERSION 
-### Copyright 2005-22 Steve Grubb <sgrubb@redhat.com>
+### Copyright 2005-23 Steve Grubb <sgrubb@redhat.com>
 ###
 ### Permission is hereby granted, free of charge, to any person obtaining a
 ### copy of this software and associated documentation files (the "Software"),
@@ -29,16 +29,16 @@
 )
 
 AC_REVISION($Revision: 1.3 $)dnl
-AC_INIT(audit,3.0.9)
-AC_PREREQ(2.12)dnl
-AM_CONFIG_HEADER(config.h)
+AC_INIT(audit, 3.1.1)
+AC_PREREQ(2.50)dnl
+AC_CONFIG_HEADERS(config.h)
 
 echo Configuring auditd $VERSION
 
 AC_CONFIG_MACRO_DIR(m4)
 AC_CANONICAL_TARGET
 AM_INIT_AUTOMAKE
-AM_PROG_LIBTOOL
+LT_INIT
 AC_SUBST(LIBTOOL_DEPS)
 OLDLIBS="$LIBS"
 m4_include(src/libev/libev.m4)
@@ -55,7 +55,6 @@
 
 echo .
 echo Checking for header files
-AC_HEADER_STDC
 AC_HEADER_TIME
 
 AC_CHECK_SIZEOF(unsigned int)
@@ -157,7 +156,7 @@
 	if test "x$use_python" = xyes ; then
 		AC_MSG_ERROR(Python explicitly requested and python headers were not found)
 	else
-		AC_MSG_WARN("Python headers not found - python bindings will not be made")
+		AC_MSG_WARN(Python headers not found - python bindings will not be made)
 	fi
 fi
 fi
@@ -209,6 +208,11 @@
 fi
 AM_CONDITIONAL(USE_PYTHON3, test ${use_python3} = "yes")
 
+if test "x$use_python" = "xyes" || test "x$use_python3" = "xyes" ; then
+	AC_CHECK_PROG(SWIG,swig,swig, no)
+	AS_IF(test x"$SWIG" == x"no", AC_MSG_ERROR(Please install swig before configuring (required by python/python3).))
+fi
+
 withval=""
 AC_MSG_CHECKING(whether to create Go language bindings)
 AC_ARG_WITH(golang,
@@ -232,7 +236,7 @@
 	if test "x$use_golang" = xyes ; then
 		AC_MSG_ERROR(Go language explicitly requested and program not found)
 	else
-		AC_MSG_WARN("Go not found - go bindings will not be made")
+		AC_MSG_WARN(Go not found - go bindings will not be made)
 	fi
     )
 fi
@@ -434,8 +438,9 @@
 			LIBWRAP_LIBS="$LIBWRAP_LIBS -lnsl" )
 		OLDLIBS="$LIBS"
 		LIBS="$LIBWRAP_LIBS $LIBS"
-		AC_TRY_LINK( int allow_severity; int deny_severity; ,
-			 hosts_access(); , ,
+		AC_LINK_IFELSE(AC_LANG_PROGRAM(
+			 int allow_severity; int deny_severity; ,
+			 hosts_access(); ),,
 			 AC_MSG_ERROR(Could not find the $withval library.  You must first install tcp_wrappers.) )
 		LIBS="$OLDLIBS"
 		;;
@@ -446,6 +451,18 @@
 	AC_DEFINE_UNQUOTED(HAVE_LIBWRAP, , Define if tcp_wrappers support is enabled )
 fi
 
+withval=""
+AC_MSG_CHECKING(whether to include io_uring support)
+AC_ARG_WITH(io_uring,
+AS_HELP_STRING(--with-io_uring,enable io_uring support),
+use_io_uring=$withval,
+use_io_uring=no)
+if test x$use_io_uring != xno ; then
+     AC_DEFINE(WITH_IO_URING,1,Define if you want to enable io_uring support.)
+fi
+# AM_CONDITIONAL(USE_IO_URING, test x$use_io_uring = xyes)
+AC_MSG_RESULT($use_io_uring)
+
 # linux/ipx.h - deprecated in 2018
 AC_CHECK_HEADER(linux/ipx.h, ipx_headers=yes, ipx_headers=no)
 if test $ipx_headers = yes ; then
@@ -459,7 +476,8 @@
 AC_SUBST(LIBWRAP_LIBS)
 #AC_SUBST(libev_LIBS)
 
-AC_OUTPUT(Makefile common/Makefile lib/Makefile lib/audit.pc lib/test/Makefile auparse/Makefile auparse/test/Makefile auparse/auparse.pc src/Makefile src/libev/Makefile src/test/Makefile docs/Makefile rules/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/builtins/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile audisp/plugins/syslog/Makefile audisp/plugins/ids/Makefile audisp/plugins/ids/rules/Makefile audisp/plugins/statsd/Makefile bindings/Makefile bindings/python/Makefile bindings/python/python2/Makefile bindings/python/python3/Makefile bindings/golang/Makefile bindings/swig/Makefile bindings/swig/src/Makefile bindings/swig/python/Makefile bindings/swig/python3/Makefile tools/Makefile tools/aulast/Makefile tools/aulastlog/Makefile tools/ausyscall/Makefile tools/auvirt/Makefile m4/Makefile)
+AC_CONFIG_FILES(Makefile common/Makefile lib/Makefile lib/audit.pc lib/test/Makefile auparse/Makefile auparse/test/Makefile auparse/auparse.pc src/Makefile src/libev/Makefile src/test/Makefile docs/Makefile rules/Makefile init.d/Makefile audisp/Makefile audisp/plugins/Makefile audisp/plugins/af_unix/Makefile audisp/plugins/remote/Makefile audisp/plugins/zos-remote/Makefile audisp/plugins/syslog/Makefile audisp/plugins/ids/Makefile audisp/plugins/ids/rules/Makefile audisp/plugins/statsd/Makefile bindings/Makefile bindings/python/Makefile bindings/python/python2/Makefile bindings/python/python3/Makefile bindings/golang/Makefile bindings/swig/Makefile bindings/swig/src/Makefile bindings/swig/python/Makefile bindings/swig/python3/Makefile tools/Makefile tools/aulast/Makefile tools/aulastlog/Makefile tools/ausyscall/Makefile tools/auvirt/Makefile m4/Makefile)
+AC_OUTPUT
 
 echo .
 echo "

_service:tar_scm:audit-3.0.9.tar.gz/docs/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/docs/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/docs/audit.rules.7 -> _service:tar_scm:audit-3.1.1.tar.gz/docs/audit.rules.7 Changed

@@ -1,4 +1,4 @@
-.TH AUDIT.RULES "7" "Jan 2019" "Red Hat" "System Administration Utilities"
+.TH AUDIT.RULES "7" "Feb 2023" "Red Hat" "System Administration Utilities"
 .SH NAME
 audit.rules \- a set of rules loaded in the kernel audit system
 .SH DESCRIPTION
@@ -43,7 +43,7 @@
 .SS System Call
 The system call rules are loaded into a matching engine that intercepts each syscall that all programs on the system makes. Therefore it is very important to only use syscall rules when you have to since these affect performance. The more rules, the bigger the performance hit. You can help the performance, though, by combining syscalls into one rule whenever possible.
 
-The Linux kernel has 5 rule matching lists or filters as they are sometimes called. They are: task, exit, user, exclude, and filesystem. The task list is checked only during the fork or clone syscalls. It is rarely used in practice.
+The Linux kernel has 6 rule matching lists or filters as they are sometimes called. They are: task, exit, user, exclude, filesystem, and io_uring. The task list is checked only during the fork or clone syscalls. It is rarely used in practice.
 
 The exit filter is the place where all syscall and file system audit requests are evaluated.
 
@@ -51,6 +51,8 @@
 
 The exclude filter is used to exclude certain events from being emitted. The msgtype and a number of subject attribute fields can be used to tell the kernel which message types you do not want to record. This filter can remove the event as a whole and is not selective about any other attribute. The user and exit filters are better suited to selectively auditing events.  The action is ignored for this filter, defaulting to "never".
 
+The io_uring filter is used to watch underlying syscalls performed by io_uring operations.
+
 Syscall rules take the general form of:
 
 .nf
@@ -71,7 +73,7 @@
 .RE
 
 The action and list are separated by a comma but no space in between. Valid lists are:
-.IR task ", " exit ", " user ", " exclude ", and " filesystem ". Their meaning was explained earlier.
+.IR task ", " exit ", " user ", " exclude ", " filesystem ", and "io_uring ". Their meaning was explained earlier.
 
 Next in the rule would normally be the
 .B \-S
@@ -172,6 +174,12 @@
 .B \-a always,exit \-F arch=b64 \-S open \-S openat \-S openat2 \-F exit=\-EPERM \-k access
 .fi
 
+.SH IO_URING RULES
+Io_uring rules do not take an arch field. It is implicit in the specification of the filter. The following example rule watches for file opens through the io_uring subsystem:
+
+.nf
+.B \-a always,io_uring \-S openat \-S openat2  \-F key=access
+
 .SH HARD WIRED EVENTS
 If auditing is enabled, then you can get any event that is not caused by syscall or file watch rules (because you don't have any rules loaded). So, that means, any event from 1100-1299, 1326, 1328, 1331 and higher can be emitted. The reason that there are a number of events that are hardwired is because they are required by regulatory compliance and are sent automatically as a convenience. (For example, logon/logoff is a mandatory event in all security guidance.) If you don't want this, you can use the exclude filter to drop events that you do not want.

_service:tar_scm:audit-3.0.9.tar.gz/docs/auditctl.8 -> _service:tar_scm:audit-3.1.1.tar.gz/docs/auditctl.8 Changed

@@ -1,4 +1,4 @@
-.TH AUDITCTL "8" "July 2021" "Red Hat" "System Administration Utilities"
+.TH AUDITCTL "8" "Feb 2023" "Red Hat" "System Administration Utilities"
 .SH NAME
 auditctl \- a utility to assist controlling the kernel's audit system
 .SH SYNOPSIS
@@ -50,11 +50,13 @@
 Reset the lost record counter shown by the status command.
 .TP
 .BI \-R\  file
-Read rules from a \fIfile\fP. The rules must be 1 per line and in the order that they are to be executed in. The rule file must be owned by root and not readable by other users or it will be rejected. The rule file may have comments embedded by starting the line with a '#' character. Rules that are read from a file are identical to what you would type on a command line except they are not preceded by auditctl (since auditctl is the one executing the file) and you would not use shell escaping since auditctl is reading the file instead of bash.
+Read and execute auditctl commands from a \fIfile\fP. The commands are executed line-by-line, in the order that they appear in the file. The file must be owned by root and not readable by other users, or else it will be rejected. Empty lines are skipped. Lines starting with the '#' character are treated as comment lines. Each line is executed as if it was provided to auditctl as command line arguments. Since auditctl is the one reading the file and not a shell such as bash, do not escape special shell characters. See the EXAMPLES section for an example.
 .TP
 .BI \-\-signal\  signal
 Send a signal to the audit daemon. You must have privileges to do this. Supported signals are
-.I TERM, HUP, USR1, USR2, CONT.
+.I TERM, HUP, USR1, USR2, CONT
+ and user friendly versions
+.I stop, reload, rotate, resume, state.
 .TP
 .BI \-t
 Trim the subtrees after a mount command.
@@ -92,6 +94,9 @@
 .TP
 .B filesystem
 Add a rule that will be applied to a whole filesystem. The filesystem must be identified with a fstype field. Normally this filter is used to exclude any events for a whole filesystem such as tracefs or debugfs.
+.TP
+.B io_uring
+Add a rule to the io_uring syscall filter. Rules against this filter specify the syscall operation using the -S syscall notion explained below. You can add a key field to the rule so that it may be grouped with other rules watching the same underlying syscall.
 .RE
 
 The following describes the valid \fIactions\fP for the rule:
@@ -163,6 +168,9 @@
 .B fsgid
 Filesystem Group ID. May be numeric or the groups name.
 .TP
+.B fstype
+File system type. This is used with the filesystem rule list. The only values supported are debugfs and tracefs.
+.TP
 .B fsuid
 Filesystem User ID. May be numeric or the user account name.
 .TP
@@ -330,6 +338,15 @@
 .B auditctl \-a always,exit \-F dir=/home/ \-F uid=0 \-C auid!=obj_uid
 .fi
 
+This is an example rules file:
+
+.nf
+# Remove all existing rules
+\-D
+# Never record sudo invocations
+\-A exclude,always \-F exe=/usr/bin/sudo
+.fi
+
 .SH DISABLED BY DEFAULT
 
 On many systems auditd is configured to install an

_service:tar_scm:audit-3.0.9.tar.gz/docs/auditd-plugins.5 -> _service:tar_scm:audit-3.1.1.tar.gz/docs/auditd-plugins.5 Changed

@@ -1,4 +1,4 @@
-.TH AUDITD-PLUGINS "5" "Aug 2022" "Red Hat" "System Administration Utilities"
+.TH AUDITD-PLUGINS "5" "Apr 2023" "Red Hat" "System Administration Utilities"
 .SH NAME
 auditd-plugins \- realtime event receivers
 .SH DESCRIPTION
@@ -32,15 +32,9 @@
 This is the absolute path to the plugin executable. In the case of internal plugins, it would be the name of the plugin.
 .TP
 .I type
-This tells the dispatcher how the plugin wants to be run. Choices are
+This tells the dispatcher how the plugin wants to be run. There is currently only one option,
 .IR builtin
-and
-.IR always.
-.IR Builtin
-should always be given for plugins that are internal to the audit event dispatcher. These are af_unix and syslog. The option
-.IR always
-should be given for most if not all plugins. The default setting is
-.IR always.
+, which is the default setting.
 .TP
 .I args
 This allows you to pass arguments to the child program. Generally plugins do not take arguments and have their own config file that instructs them how they should be configured. At the moment, there is a limit of 2 args.
@@ -66,12 +60,21 @@
 auditctl -s
 
 When tuning the audit system's performance, you'd want to check both kernel and auditd metrics and adjust accordingly.
+
+.SH NOTES FOR DEVELOPERS
+When the audit daemon starts your plugin, you will be running as root. If you do not need root privileges, you should change uid/gid to lower chances of being a target for exploit. If you need to retain capabilities, using \fBlibcap-ng\fP is the simplest way.
+
+Your environment is not going to be clean. You are inheriting many attributes from auditd itself. You will need to adjust your \fBsignal mask\fP, \fBsigaction\fP, \fBumask\fP, and \fBenvironmental variables\fP. Look at the auditd man page to see which signals auditd used. Plugins are expected to handle \fBSIGTERM\fP and \fBSIGHUP\fP. You will also inherit the resource limits of auditd. Note that some of these resource limits, such as maximum number of open descriptors, are controlled by systemd. You also inherit auditd's nice value. You might want to adjust that to be sure to keep up with incoming audit events.
+
+Auditd will send events to the plugin on it's \fBstdin\fP. The plugin has to keep this descriptor empty so that events don't back up. If you do significant processing of each event, you should add an internal queue to your design in order to keep events flowing. The \fBauparse_feed\fP function is the preferred way to examine whole events if you need to analyze the contents of the events.
  
 .SH FILES
 /etc/auditd/auditd.conf
 /etc/audit/plugins.d
 .SH "SEE ALSO"
 .BR auditd.conf (5),
-.BR auditd (8).
+.BR auditd (8),
+.BR execve(2),
+.BR auparse_feed(3).
 .SH AUTHOR
 Steve Grubb

_service:tar_scm:audit-3.0.9.tar.gz/docs/auparse_init.3 -> _service:tar_scm:audit-3.1.1.tar.gz/docs/auparse_init.3 Changed

_service:tar_scm:audit-3.0.9.tar.gz/docs/aureport.8 -> _service:tar_scm:audit-3.1.1.tar.gz/docs/aureport.8 Changed

@@ -1,4 +1,4 @@
-.TH AUREPORT "8" "March 2017" "Red Hat" "System Administration Utilities"
+.TH AUREPORT "8" "February 2023" "Red Hat" "System Administration Utilities"
 .SH NAME
 aureport \- a tool that produces summary reports of audit daemon logs
 .SH SYNOPSIS
@@ -109,7 +109,7 @@
 .B now
 is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable.
 
-You may also use the word: \fBnow\fP, \fBrecent\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, \fBthis\-year\fP. \fBNow\fP means starting now. \fBRecent\fP is 10 minutes ago. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means now. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
+You may also use the word: \fBnow\fP, \fBrecent\fP, \fBthis-hour\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, \fBthis\-year\fP. \fBNow\fP means starting now. \fBRecent\fP is 10 minutes ago. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means now. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
 .TP
 .BR \-tm ,\  \-\-terminal
 Report about terminals
@@ -121,7 +121,7 @@
 .B midnight
 is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable.
 
-You may also use the word: \fBnow\fP, \fBrecent\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, \fBthis\-year\fP. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means starting at 1 second after midnight. \fBRecent\fP is 10 minutes ago. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means starting 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
+You may also use the word: \fBnow\fP, \fBrecent\fP, \fBthis-hour\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, \fBthis\-year\fP. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means starting at 1 second after midnight. \fBRecent\fP is 10 minutes ago. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means starting 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
 .TP
 .BR \-u ,\  \-\-user
 Report about users

_service:tar_scm:audit-3.0.9.tar.gz/docs/ausearch.8 -> _service:tar_scm:audit-3.1.1.tar.gz/docs/ausearch.8 Changed

@@ -1,4 +1,4 @@
-.TH AUSEARCH "8" "April 2021" "Red Hat" "System Administration Utilities"
+.TH AUSEARCH "8" "February 2023" "Red Hat" "System Administration Utilities"
 .SH NAME
 ausearch \- a tool to query audit daemon logs
 .SH SYNOPSIS
@@ -154,7 +154,7 @@
 .B now
 is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable.
 
-You may also use the word: \fBnow\fP, \fBrecent\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, or \fBthis\-year\fP. \fBNow\fP means starting now. \fBRecent\fP is 10 minutes ago. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means now. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
+You may also use the word: \fBnow\fP, \fBrecent\fP, \fBthis-hour\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, or \fBthis\-year\fP. \fBNow\fP means starting now. \fBRecent\fP is 10 minutes ago. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means now. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
 .TP
 .BR \-ts ,\  \-\-start \ \fIstart-date\fP\ \fIstart-time\fP
 Search for events with time stamps equal to or after the given start time. The format of start time depends on your locale. You can check the format of your locale by running
@@ -165,7 +165,7 @@
 .B midnight
 is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable.
 
-You may also use the word: \fBnow\fP, \fBrecent\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, \fBthis\-year\fP, or \fBcheckpoint\fP. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means starting at 1 second after midnight. \fBRecent\fP is 10 minutes ago. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means starting 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
+You may also use the word: \fBnow\fP, \fBrecent\fP, \fBthis-hour\fP, \fBboot\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, \fBthis\-year\fP, or \fBcheckpoint\fP. \fBBoot\fP means the time of day to the second when the system last booted. \fBToday\fP means starting at 1 second after midnight. \fBRecent\fP is 10 minutes ago. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBWeek\-ago\fP means starting 1 second after midnight exactly 7 days ago. \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
 .sp
 \fBcheckpoint\fP means \fIausearch\fP will use the timestamp found within a valid checkpoint file ignoring the recorded inode, device, serial, node and event type also found within a checkpoint file. Essentially, this is the recovery action should an invocation of \fIausearch\fP with a checkpoint option fail with an exit status of 10, 11 or 12. It could be used in a shell script something like:
 .sp

_service:tar_scm:audit-3.0.9.tar.gz/init.d/Makefile.am -> _service:tar_scm:audit-3.1.1.tar.gz/init.d/Makefile.am Changed

_service:tar_scm:audit-3.0.9.tar.gz/init.d/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/init.d/Makefile.in Changed

@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 # Makefile.am--
-# Copyright 2004-07,2012-13,2018 Red Hat Inc., Durham, North Carolina.
+# Copyright 2004-07,2012-13,2018 Red Hat Inc.
 # All Rights Reserved.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -190,6 +190,7 @@
 BUILD_EXEEXT = @BUILD_EXEEXT@
 BUILD_OBJEXT = @BUILD_OBJEXT@
 CAPNG_LDADD = @CAPNG_LDADD@
+CAPNG_PKG = @CAPNG_PKG@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CC_FOR_BUILD = @CC_FOR_BUILD@
@@ -270,6 +271,7 @@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
+SWIG = @SWIG@
 VERSION = @VERSION@
 WFLAGS = @WFLAGS@
 abs_builddir = @abs_builddir@
@@ -633,7 +635,7 @@
 @ENABLE_SYSTEMD_TRUE@	$(INSTALL_SCRIPT) -D -m 750 ${srcdir}/auditd.condrestart ${DESTDIR}${legacydir}/condrestart
 @ENABLE_SYSTEMD_TRUE@	$(INSTALL_SCRIPT) -D -m 750 ${srcdir}/audit-functions ${DESTDIR}${libexecdir}
 @ENABLE_SYSTEMD_FALSE@	$(INSTALL_SCRIPT) -D ${srcdir}/auditd.init ${DESTDIR}${initdir}/auditd
-	chmod 0750 $(DESTDIR)$(sbindir)/augenrules
+	chmod 0755 $(DESTDIR)$(sbindir)/augenrules
 
 uninstall-hook:
 	rm ${DESTDIR}${sysconfdir}/${libconfig}

_service:tar_scm:audit-3.0.9.tar.gz/init.d/auditd.service -> _service:tar_scm:audit-3.1.1.tar.gz/init.d/auditd.service Changed

_service:tar_scm:audit-3.0.9.tar.gz/init.d/augenrules -> _service:tar_scm:audit-3.1.1.tar.gz/init.d/augenrules Changed

@@ -60,7 +60,7 @@
 # Check environment
 if  ! -d ${SourceRulesDir} ; then
 	echo "$0: No rules directory - ${SourceRulesDir}"
-	rm -f ${TmpRules}
+	rm -f "${TmpRules}"
 	try_load
 	exit 1
 fi
@@ -73,9 +73,9 @@
 #   - the last processed -f directory is emitted as the third line
 #   - the last processed -e directive is emitted as the last line
 umask 0137
-echo "## This file is automatically generated from $SourceRulesDir" >> ${TmpRules}
+echo "## This file is automatically generated from $SourceRulesDir" >> "${TmpRules}"
 for rules in $(/bin/ls -1v ${SourceRulesDir} | grep "\.rules$") ; do
-	cat ${SourceRulesDir}/${rules}
+	cat ${SourceRulesDir}/"${rules}"
 done | awk '
 BEGIN   {
         minus_e = "";
@@ -84,6 +84,7 @@
         minus_b = "";
         rest = 0;
 } {
+        sub(/\r$/, "");
         if (length($0) < 1) { next; }
         if (match($0, "^\\s*#")) { next; }
         if (match($0, "^\\s*-e")) { minus_e = $0; next; }
@@ -96,26 +97,26 @@
         printf "%s\n%s\n%s\n", minus_D, minus_b, minus_f;
         for (i = 0; i < rest; i++) { printf "%s\n", rulesi; }
         printf "%s\n", minus_e;
-}' >> ${TmpRules}
+}' >> "${TmpRules}"
 
 # If empty then quit
-if  ! -s ${TmpRules} ; then
+if  ! -s "${TmpRules}" ; then
 	echo "$0: No rules"
-	rm -f ${TmpRules}
+	rm -f "${TmpRules}"
 	try_load
 	exit $RETVAL
 fi
 
 # If the same then quit
-cmp -s ${TmpRules} ${DestinationFile} > /dev/null 2>&1
+cmp -s "${TmpRules}" ${DestinationFile} > /dev/null 2>&1
 if  $? -eq 0 ; then
 	echo "$0: No change"
-	rm -f ${TmpRules}
+	rm -f "${TmpRules}"
 	try_load
 	exit $RETVAL
 elif  $OnlyCheck -eq 1  ; then
 	echo "$0: Rules have changed and should be updated"
-	rm -f ${TmpRules}
+	rm -f "${TmpRules}"
 	exit 0
 fi
 
@@ -124,13 +125,13 @@
 	cp ${DestinationFile} ${DestinationFile}.${ASuffix}
 fi
 # We copy the file so that it gets the right selinux lable
-cp ${TmpRules} ${DestinationFile}
+cp "${TmpRules}" ${DestinationFile}
 chmod 0640 ${DestinationFile}
 # Restore context on MLS system. /tmp is SystemLow & audit.rules is SystemHigh
 if  -x /usr/sbin/restorecon  ; then
 	/usr/sbin/restorecon -F ${DestinationFile}
 fi
-rm -f ${TmpRules}
+rm -f "${TmpRules}"
 
 try_load
 exit $RETVAL

_service:tar_scm:audit-3.0.9.tar.gz/lib/Makefile.am -> _service:tar_scm:audit-3.1.1.tar.gz/lib/Makefile.am Changed

@@ -47,7 +47,7 @@
 BUILT_SOURCES = actiontabs.h errtabs.h fieldtabs.h flagtabs.h \
 	fstypetabs.h ftypetabs.h i386_tables.h machinetabs.h \
 	msg_typetabs.h optabs.h ppc_tables.h s390_tables.h \
-	s390x_tables.h x86_64_tables.h
+	s390x_tables.h x86_64_tables.h uringop_tables.h
 if USE_ARM
 BUILT_SOURCES += arm_tables.h
 endif
@@ -58,7 +58,7 @@
 	gen_flagtabs_h gen_fstypetabs_h gen_ftypetabs_h gen_i386_tables_h \
 	gen_machinetabs_h gen_msg_typetabs_h \
 	gen_optabs_h gen_ppc_tables_h gen_s390_tables_h \
-	gen_s390x_tables_h gen_x86_64_tables_h
+	gen_s390x_tables_h gen_x86_64_tables_h gen_uringop_tables_h
 if USE_ARM
 noinst_PROGRAMS += gen_arm_tables_h
 endif
@@ -266,6 +266,19 @@
 s390x_tables.h: gen_s390x_tables_h Makefile
 	./gen_s390x_tables_h --lowercase --i2s --s2i s390x_syscall > $@
 
+gen_uringop_tables_h_SOURCES = gen_tables.c gen_tables.h uringop_table.h
+gen_uringop_tables_h_CFLAGS = '-DTABLE_H="uringop_table.h"'
+$(gen_uringop_tables_h_OBJECTS): CC=$(CC_FOR_BUILD)
+$(gen_uringop_tables_h_OBJECTS): CFLAGS=$(CFLAGS_FOR_BUILD)
+$(gen_uringop_tables_h_OBJECTS): CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
+$(gen_uringop_tables_h_OBJECTS): LDFLAGS=$(LDFLAGS_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): CC=$(CC_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): CFLAGS=$(CFLAGS_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): LDFLAGS=$(LDFLAGS_FOR_BUILD)
+uringop_tables.h: gen_uringop_tables_h Makefile
+	./gen_uringop_tables_h --lowercase --i2s --s2i uringop > $@
+
 gen_x86_64_tables_h_SOURCES = gen_tables.c gen_tables.h x86_64_table.h
 gen_x86_64_tables_h_CFLAGS = '-DTABLE_H="x86_64_table.h"'
 $(gen_x86_64_tables_h_OBJECTS): CC=$(CC_FOR_BUILD)

_service:tar_scm:audit-3.0.9.tar.gz/lib/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/lib/Makefile.in Changed

@@ -124,7 +124,7 @@
 	gen_msg_typetabs_h$(EXEEXT) gen_optabs_h$(EXEEXT) \
 	gen_ppc_tables_h$(EXEEXT) gen_s390_tables_h$(EXEEXT) \
 	gen_s390x_tables_h$(EXEEXT) gen_x86_64_tables_h$(EXEEXT) \
-	$(am__EXEEXT_1) $(am__EXEEXT_2)
+	gen_uringop_tables_h$(EXEEXT) $(am__EXEEXT_1) $(am__EXEEXT_2)
 @USE_ARM_TRUE@am__append_3 = gen_arm_tables_h
 @USE_AARCH64_TRUE@am__append_4 = gen_aarch64_tables_h
 subdir = lib
@@ -300,6 +300,14 @@
 	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
 	$(gen_s390x_tables_h_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
+am_gen_uringop_tables_h_OBJECTS =  \
+	gen_uringop_tables_h-gen_tables.$(OBJEXT)
+gen_uringop_tables_h_OBJECTS = $(am_gen_uringop_tables_h_OBJECTS)
+gen_uringop_tables_h_LDADD = $(LDADD)
+gen_uringop_tables_h_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(gen_uringop_tables_h_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+	$(LDFLAGS) -o $@
 am_gen_x86_64_tables_h_OBJECTS =  \
 	gen_x86_64_tables_h-gen_tables.$(OBJEXT)
 gen_x86_64_tables_h_OBJECTS = $(am_gen_x86_64_tables_h_OBJECTS)
@@ -340,6 +348,7 @@
 	./$(DEPDIR)/gen_ppc_tables_h-gen_tables.Po \
 	./$(DEPDIR)/gen_s390_tables_h-gen_tables.Po \
 	./$(DEPDIR)/gen_s390x_tables_h-gen_tables.Po \
+	./$(DEPDIR)/gen_uringop_tables_h-gen_tables.Po \
 	./$(DEPDIR)/gen_x86_64_tables_h-gen_tables.Po \
 	./$(DEPDIR)/libaudit.Plo ./$(DEPDIR)/lookup_table.Plo \
 	./$(DEPDIR)/message.Plo ./$(DEPDIR)/netlink.Plo
@@ -370,7 +379,8 @@
 	$(gen_i386_tables_h_SOURCES) $(gen_machinetabs_h_SOURCES) \
 	$(gen_msg_typetabs_h_SOURCES) $(gen_optabs_h_SOURCES) \
 	$(gen_ppc_tables_h_SOURCES) $(gen_s390_tables_h_SOURCES) \
-	$(gen_s390x_tables_h_SOURCES) $(gen_x86_64_tables_h_SOURCES)
+	$(gen_s390x_tables_h_SOURCES) $(gen_uringop_tables_h_SOURCES) \
+	$(gen_x86_64_tables_h_SOURCES)
 DIST_SOURCES = $(libaudit_la_SOURCES) \
 	$(am__gen_aarch64_tables_h_SOURCES_DIST) \
 	$(gen_actiontabs_h_SOURCES) \
@@ -380,7 +390,8 @@
 	$(gen_i386_tables_h_SOURCES) $(gen_machinetabs_h_SOURCES) \
 	$(gen_msg_typetabs_h_SOURCES) $(gen_optabs_h_SOURCES) \
 	$(gen_ppc_tables_h_SOURCES) $(gen_s390_tables_h_SOURCES) \
-	$(gen_s390x_tables_h_SOURCES) $(gen_x86_64_tables_h_SOURCES)
+	$(gen_s390x_tables_h_SOURCES) $(gen_uringop_tables_h_SOURCES) \
+	$(gen_x86_64_tables_h_SOURCES)
 RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \
 	ctags-recursive dvi-recursive html-recursive info-recursive \
 	install-data-recursive install-dvi-recursive \
@@ -461,6 +472,7 @@
 BUILD_EXEEXT = @BUILD_EXEEXT@
 BUILD_OBJEXT = @BUILD_OBJEXT@
 CAPNG_LDADD = @CAPNG_LDADD@
+CAPNG_PKG = @CAPNG_PKG@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CC_FOR_BUILD = @CC_FOR_BUILD@
@@ -541,6 +553,7 @@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
+SWIG = @SWIG@
 VERSION = @VERSION@
 WFLAGS = @WFLAGS@
 abs_builddir = @abs_builddir@
@@ -633,7 +646,8 @@
 BUILT_SOURCES = actiontabs.h errtabs.h fieldtabs.h flagtabs.h \
 	fstypetabs.h ftypetabs.h i386_tables.h machinetabs.h \
 	msg_typetabs.h optabs.h ppc_tables.h s390_tables.h \
-	s390x_tables.h x86_64_tables.h $(am__append_1) $(am__append_2)
+	s390x_tables.h x86_64_tables.h uringop_tables.h \
+	$(am__append_1) $(am__append_2)
 gen_actiontabs_h_SOURCES = gen_tables.c gen_tables.h actiontab.h
 gen_actiontabs_h_CFLAGS = '-DTABLE_H="actiontab.h"'
 @USE_ARM_TRUE@gen_arm_tables_h_SOURCES = gen_tables.c gen_tables.h arm_table.h
@@ -664,6 +678,8 @@
 gen_s390_tables_h_CFLAGS = '-DTABLE_H="s390_table.h"'
 gen_s390x_tables_h_SOURCES = gen_tables.c gen_tables.h s390x_table.h
 gen_s390x_tables_h_CFLAGS = '-DTABLE_H="s390x_table.h"'
+gen_uringop_tables_h_SOURCES = gen_tables.c gen_tables.h uringop_table.h
+gen_uringop_tables_h_CFLAGS = '-DTABLE_H="uringop_table.h"'
 gen_x86_64_tables_h_SOURCES = gen_tables.c gen_tables.h x86_64_table.h
 gen_x86_64_tables_h_CFLAGS = '-DTABLE_H="x86_64_table.h"'
 all: $(BUILT_SOURCES)
@@ -810,6 +826,10 @@
 	@rm -f gen_s390x_tables_h$(EXEEXT)
 	$(AM_V_CCLD)$(gen_s390x_tables_h_LINK) $(gen_s390x_tables_h_OBJECTS) $(gen_s390x_tables_h_LDADD) $(LIBS)
 
+gen_uringop_tables_h$(EXEEXT): $(gen_uringop_tables_h_OBJECTS) $(gen_uringop_tables_h_DEPENDENCIES) $(EXTRA_gen_uringop_tables_h_DEPENDENCIES) 
+	@rm -f gen_uringop_tables_h$(EXEEXT)
+	$(AM_V_CCLD)$(gen_uringop_tables_h_LINK) $(gen_uringop_tables_h_OBJECTS) $(gen_uringop_tables_h_LDADD) $(LIBS)
+
 gen_x86_64_tables_h$(EXEEXT): $(gen_x86_64_tables_h_OBJECTS) $(gen_x86_64_tables_h_DEPENDENCIES) $(EXTRA_gen_x86_64_tables_h_DEPENDENCIES) 
 	@rm -f gen_x86_64_tables_h$(EXEEXT)
 	$(AM_V_CCLD)$(gen_x86_64_tables_h_LINK) $(gen_x86_64_tables_h_OBJECTS) $(gen_x86_64_tables_h_LDADD) $(LIBS)
@@ -837,6 +857,7 @@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/gen_ppc_tables_h-gen_tables.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/gen_s390_tables_h-gen_tables.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/gen_s390x_tables_h-gen_tables.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/gen_uringop_tables_h-gen_tables.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/gen_x86_64_tables_h-gen_tables.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libaudit.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lookup_table.Plo@am__quote@ # am--include-marker
@@ -1080,6 +1101,20 @@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(gen_s390x_tables_h_CFLAGS) $(CFLAGS) -c -o gen_s390x_tables_h-gen_tables.obj `if test -f 'gen_tables.c'; then $(CYGPATH_W) 'gen_tables.c'; else $(CYGPATH_W) '$(srcdir)/gen_tables.c'; fi`
 
+gen_uringop_tables_h-gen_tables.o: gen_tables.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(gen_uringop_tables_h_CFLAGS) $(CFLAGS) -MT gen_uringop_tables_h-gen_tables.o -MD -MP -MF $(DEPDIR)/gen_uringop_tables_h-gen_tables.Tpo -c -o gen_uringop_tables_h-gen_tables.o `test -f 'gen_tables.c' || echo '$(srcdir)/'`gen_tables.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/gen_uringop_tables_h-gen_tables.Tpo $(DEPDIR)/gen_uringop_tables_h-gen_tables.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='gen_tables.c' object='gen_uringop_tables_h-gen_tables.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(gen_uringop_tables_h_CFLAGS) $(CFLAGS) -c -o gen_uringop_tables_h-gen_tables.o `test -f 'gen_tables.c' || echo '$(srcdir)/'`gen_tables.c
+
+gen_uringop_tables_h-gen_tables.obj: gen_tables.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(gen_uringop_tables_h_CFLAGS) $(CFLAGS) -MT gen_uringop_tables_h-gen_tables.obj -MD -MP -MF $(DEPDIR)/gen_uringop_tables_h-gen_tables.Tpo -c -o gen_uringop_tables_h-gen_tables.obj `if test -f 'gen_tables.c'; then $(CYGPATH_W) 'gen_tables.c'; else $(CYGPATH_W) '$(srcdir)/gen_tables.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/gen_uringop_tables_h-gen_tables.Tpo $(DEPDIR)/gen_uringop_tables_h-gen_tables.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='gen_tables.c' object='gen_uringop_tables_h-gen_tables.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(gen_uringop_tables_h_CFLAGS) $(CFLAGS) -c -o gen_uringop_tables_h-gen_tables.obj `if test -f 'gen_tables.c'; then $(CYGPATH_W) 'gen_tables.c'; else $(CYGPATH_W) '$(srcdir)/gen_tables.c'; fi`
+
 gen_x86_64_tables_h-gen_tables.o: gen_tables.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(gen_x86_64_tables_h_CFLAGS) $(CFLAGS) -MT gen_x86_64_tables_h-gen_tables.o -MD -MP -MF $(DEPDIR)/gen_x86_64_tables_h-gen_tables.Tpo -c -o gen_x86_64_tables_h-gen_tables.o `test -f 'gen_tables.c' || echo '$(srcdir)/'`gen_tables.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/gen_x86_64_tables_h-gen_tables.Tpo $(DEPDIR)/gen_x86_64_tables_h-gen_tables.Po
@@ -1365,6 +1400,7 @@
 	-rm -f ./$(DEPDIR)/gen_ppc_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/gen_s390_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/gen_s390x_tables_h-gen_tables.Po
+	-rm -f ./$(DEPDIR)/gen_uringop_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/gen_x86_64_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/libaudit.Plo
 	-rm -f ./$(DEPDIR)/lookup_table.Plo
@@ -1432,6 +1468,7 @@
 	-rm -f ./$(DEPDIR)/gen_ppc_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/gen_s390_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/gen_s390x_tables_h-gen_tables.Po
+	-rm -f ./$(DEPDIR)/gen_uringop_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/gen_x86_64_tables_h-gen_tables.Po
 	-rm -f ./$(DEPDIR)/libaudit.Plo
 	-rm -f ./$(DEPDIR)/lookup_table.Plo
@@ -1631,6 +1668,16 @@
 gen_s390x_tables_h$(BUILD_EXEEXT): LDFLAGS=$(LDFLAGS_FOR_BUILD)
 s390x_tables.h: gen_s390x_tables_h Makefile
 	./gen_s390x_tables_h --lowercase --i2s --s2i s390x_syscall > $@
+$(gen_uringop_tables_h_OBJECTS): CC=$(CC_FOR_BUILD)
+$(gen_uringop_tables_h_OBJECTS): CFLAGS=$(CFLAGS_FOR_BUILD)
+$(gen_uringop_tables_h_OBJECTS): CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
+$(gen_uringop_tables_h_OBJECTS): LDFLAGS=$(LDFLAGS_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): CC=$(CC_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): CFLAGS=$(CFLAGS_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
+gen_uringop_tables_h$(BUILD_EXEEXT): LDFLAGS=$(LDFLAGS_FOR_BUILD)
+uringop_tables.h: gen_uringop_tables_h Makefile
+	./gen_uringop_tables_h --lowercase --i2s --s2i uringop > $@
 $(gen_x86_64_tables_h_OBJECTS): CC=$(CC_FOR_BUILD)
 $(gen_x86_64_tables_h_OBJECTS): CFLAGS=$(CFLAGS_FOR_BUILD)
 $(gen_x86_64_tables_h_OBJECTS): CPPFLAGS=$(CPPFLAGS_FOR_BUILD)

_service:tar_scm:audit-3.0.9.tar.gz/lib/audit.pc.in -> _service:tar_scm:audit-3.1.1.tar.gz/lib/audit.pc.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/lib/flagtab.h -> _service:tar_scm:audit-3.1.1.tar.gz/lib/flagtab.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/lib/libaudit.c -> _service:tar_scm:audit-3.1.1.tar.gz/lib/libaudit.c Changed

@@ -43,6 +43,9 @@
 #ifdef HAVE_LIBCAP_NG
 #include <cap-ng.h>
 #endif
+#ifdef WITH_IO_URING
+#include <linux/io_uring.h>
+#endif
 #include "libaudit.h"
 #include "private.h"
 #include "errormsg.h"
@@ -50,6 +53,9 @@
 
 /* #defines for the audit failure query  */
 #define CONFIG_FILE "/etc/libaudit.conf"
+#ifndef IORING_OP_LAST
+#define IORING_OP_LAST 37
+#endif
 
 /* Local prototypes */
 struct nv_pair
@@ -997,6 +1003,7 @@
 	if (word > (AUDIT_BITMASK_SIZE-1))
 		return -1;
 	rule->maskword |= bit;
+	_audit_syscalladded = 1;
 	return 0;
 }
 
@@ -1027,6 +1034,32 @@
 	return -1;
 }
 
+int audit_rule_io_uringbyname_data(struct audit_rule_data *rule,
+                                  const char *scall)
+{
+#ifdef WITH_IO_URING
+	int nr;
+
+	if (!strcmp(scall, "all")) {
+		int i, rc = 0;
+		for (i = 0; i < IORING_OP_LAST && !rc; i++) {
+			// while names resolve
+			if (audit_uringop_to_name(i))
+				rc = audit_rule_syscall_data(rule, i);
+		}
+		return rc;
+	}
+	nr = audit_name_to_uringop(scall);
+	if (nr < 0) {
+		if (isdigit(scall0))
+			nr = strtol(scall, NULL, 0);
+	}
+	if (nr >= 0)
+		return audit_rule_syscall_data(rule, nr);
+#endif
+	return -1;
+}
+
 int audit_rule_interfield_comp_data(struct audit_rule_data **rulep,
 					 const char *pair,
 					 int flags)
@@ -1427,6 +1460,7 @@
 		case MACH_86_64:   /* fallthrough */
 		case MACH_PPC64:   /* fallthrough */
 		case MACH_S390X:   /* fallthrough */
+		case MACH_IO_URING:
 			break;
 		case MACH_PPC64LE: /* 64 bit only */
 			if (bits && bits != __AUDIT_ARCH_64BIT)
@@ -1502,13 +1536,11 @@
 	if ((field = audit_name_to_field(f)) < 0)
 		return -EAU_FIELDUNKNOWN;
 
-	/* Exclude filter can be used only with MSGTYPE, cred and EXE fields */
+	/* Exclude filter can be used only with MSGTYPE, cred, and EXE fields
+	 * when the EXTEND Feature is not present. */
 	if (flags == AUDIT_FILTER_EXCLUDE) {
 		uint32_t features = audit_get_features();
 		if ((features & AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND) == 0) {
-			if (field != AUDIT_MSGTYPE)
-				return -EAU_FIELDNOSUPPORT;
-		} else {
 			switch(field) {
 				case AUDIT_PID:
 				case AUDIT_UID:
@@ -1707,7 +1739,8 @@
 			_audit_archadded = 1;
 			break;
 		case AUDIT_PERM:
-			if (flags != AUDIT_FILTER_EXIT)
+			if (!(flags == AUDIT_FILTER_EXIT ||
+			      flags == AUDIT_FILTER_EXCLUDE))
 				return -EAU_EXITONLY;
 			else if (op != AUDIT_EQUAL)
 				return -EAU_OPEQ;

_service:tar_scm:audit-3.0.9.tar.gz/lib/libaudit.h -> _service:tar_scm:audit-3.1.1.tar.gz/lib/libaudit.h Changed

@@ -1,5 +1,5 @@
 /* libaudit.h --
- * Copyright 2004-2018,2021-22 Red Hat Inc.
+ * Copyright 2004-2018,2021-23 Red Hat Inc.
  * All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -321,6 +321,14 @@
 #define AUDIT_OPENAT2		1337 /* openat2 open_how flags */
 #endif
 
+#ifndef AUDIT_DM_CTRL
+#define AUDIT_DM_CTRL		1338 /* Device Mapper target control */
+#endif
+
+#ifndef AUDIT_DM_EVENT
+#define AUDIT_DM_EVENT		1339 /* Device Mapper events */
+#endif
+
 #ifndef AUDIT_MAC_CALIPSO_ADD
 #define AUDIT_MAC_CALIPSO_ADD	1418 /* NetLabel: add CALIPSO DOI entry */
 #endif
@@ -344,6 +352,9 @@
 #ifndef AUDIT_FILTER_FS
 #define AUDIT_FILTER_FS		0x06 /* FS record filter in __audit_inode_child */
 #endif
+#ifndef AUDIT_FILTER_URING_EXIT
+#define AUDIT_FILTER_URING_EXIT 0x07 /* Apply rule at io_uring op exit */
+#endif
 #ifndef AUDIT_FILTER_EXCLUDE
 #define AUDIT_FILTER_EXCLUDE	AUDIT_FILTER_TYPE
 #endif
@@ -585,7 +596,8 @@
 	MACH_ALPHA,	// Deprecated but has to stay
 	MACH_ARM,
 	MACH_AARCH64,
-	MACH_PPC64LE
+	MACH_PPC64LE,
+	MACH_IO_URING
 } machine_t;
 
 /* These are the valid audit failure tunable enum values */
@@ -620,6 +632,8 @@
 extern const char *audit_field_to_name(int field);
 extern int        audit_name_to_syscall(const char *sc, int machine);
 extern const char *audit_syscall_to_name(int sc, int machine);
+extern const char *audit_uringop_to_name(int uringop);
+extern int        audit_name_to_uringop(const char *uringop);
 extern int        audit_name_to_flag(const char *flag);
 extern const char *audit_flag_to_name(int flag);
 extern int        audit_name_to_action(const char *action);
@@ -720,6 +734,9 @@
 extern void audit_rule_init_data(struct audit_rule_data *rule);
 extern int audit_rule_syscallbyname_data(struct audit_rule_data *rule,
                                           const char *scall);
+extern int audit_rule_io_uringbyname_data(struct audit_rule_data *rule,
+                                          const char *scall);
+
 /* Note that the following function takes a **, where audit_rule_fieldpair()
  * takes just a *.  That structure may need to be reallocated as a result of
  * adding new fields */

_service:tar_scm:audit-3.0.9.tar.gz/lib/lookup_table.c -> _service:tar_scm:audit-3.1.1.tar.gz/lib/lookup_table.c Changed

@@ -46,6 +46,9 @@
 #include "s390_tables.h"
 #include "s390x_tables.h"
 #include "x86_64_tables.h"
+#ifdef WITH_IO_URING
+#include "uringop_tables.h"
+#endif
 #include "errtabs.h"
 #include "fstypetabs.h"
 #include "ftypetabs.h"
@@ -99,6 +102,20 @@
 #endif
 }
 
+int audit_name_to_uringop(const char *uringop)
+{
+#ifdef WITH_IO_URING
+	int res = -1, found = 0;
+
+#ifndef NO_TABLES
+	found = uringop_s2i(uringop, &res);
+#endif
+	if (found)
+		return res;
+#endif
+	return -1;
+}
+
 int audit_name_to_syscall(const char *sc, int machine)
 {
 	int res = -1, found = 0;
@@ -134,6 +151,9 @@
 			break;
 #endif
 #endif
+		case MACH_IO_URING:
+			return audit_name_to_uringop(sc);
+			break;
 		default:
 			return -1;
 	}
@@ -142,6 +162,16 @@
 	return -1;
 }
 
+const char *audit_uringop_to_name(int uringop)
+{
+#ifdef WITH_IO_URING
+#ifndef NO_TABLES
+	return uringop_i2s(uringop);
+#endif
+#endif
+	return NULL;
+}
+
 const char *audit_syscall_to_name(int sc, int machine)
 {
 #ifndef NO_TABLES
@@ -167,6 +197,8 @@
 	        case MACH_AARCH64:
 			return aarch64_syscall_i2s(sc);
 #endif
+		case MACH_IO_URING:
+			return audit_uringop_to_name(sc);
 	}
 #endif
 	return NULL;

_service:tar_scm:audit-3.0.9.tar.gz/lib/machinetab.h -> _service:tar_scm:audit-3.1.1.tar.gz/lib/machinetab.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/lib/msg_typetab.h -> _service:tar_scm:audit-3.1.1.tar.gz/lib/msg_typetab.h Changed

@@ -1,5 +1,5 @@
 /* msg_typetab.h --
- * Copyright 2005-07,2009-18,21 Red Hat Inc.
+ * Copyright 2005-07,2009-18,21-23 Red Hat Inc.
  * All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -129,13 +129,15 @@
 _S(AUDIT_EVENT_LISTENER,             "EVENT_LISTENER"                )
 _S(AUDIT_URINGOP,                    "URINGOP"                       )
 _S(AUDIT_OPENAT2,                    "OPENAT2"                       )
+_S(AUDIT_DM_CTRL,                    "DM_CTRL"                       )
+_S(AUDIT_DM_EVENT,                   "DM_EVENT"                      )
 _S(AUDIT_AVC,                        "AVC"                           )
 _S(AUDIT_SELINUX_ERR,                "SELINUX_ERR"                   )
 _S(AUDIT_AVC_PATH,                   "AVC_PATH"                      )
 _S(AUDIT_MAC_POLICY_LOAD,            "MAC_POLICY_LOAD"               )
 _S(AUDIT_MAC_STATUS,                 "MAC_STATUS"                    )
 _S(AUDIT_MAC_CONFIG_CHANGE,          "MAC_CONFIG_CHANGE"             )
-_S(AUDIT_MAC_UNLBL_ALLOW,            "MAC_UNLBL_ALLOW"               )       
+_S(AUDIT_MAC_UNLBL_ALLOW,            "MAC_UNLBL_ALLOW"               )
 _S(AUDIT_MAC_CIPSOV4_ADD,            "MAC_CIPSOV4_ADD"               )
 _S(AUDIT_MAC_CIPSOV4_DEL,            "MAC_CIPSOV4_DEL"               )
 _S(AUDIT_MAC_MAP_ADD,                "MAC_MAP_ADD"                   )

_service:tar_scm:audit-3.0.9.tar.gz/lib/test/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/lib/test/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/lib/test/lookup_test.c -> _service:tar_scm:audit-3.1.1.tar.gz/lib/test/lookup_test.c Changed

_service:tar_scm:audit-3.1.1.tar.gz/lib/uringop_table.h Added

@@ -0,0 +1,53 @@
+/* uringop_table.h --
+ * Copyright 2005-23 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Authors:
+ *      Richard Guy Briggs <rgb@redhat.com>
+ */
+
+/*
+ *  From /usr/include/linux/io_uring.h
+ *  kernel location here: io_uring/opdef.c
+ *
+ *  Note: not all ops are auditable for performance reasons. This was
+ *  discussed on the linux-audit mail list:
+ *  https://listman.redhat.com/archives/linux-audit/2021-June/018042.html
+ */
+
+_S(9,	"sendmsg")
+_S(10,	"recvmsg")
+_S(13,	"accept")
+_S(16,	"connect")
+_S(17,	"fallocate")
+_S(18,	"openat")
+_S(19,	"close")
+_S(28,	"openat2")
+_S(34,	"shutdown")
+_S(35,	"renameat")
+_S(36,	"unlinkat")
+_S(37,  "mkdirat")
+_S(38,  "symlinkat")
+_S(39,  "linkat")
+_S(40,  "msg_ring")
+_S(41,  "fsetxattr")
+_S(42,  "setxattr")
+_S(43,  "fgetxattr")
+_S(44,  "getxattr")
+_S(46,  "uring_cmd")
+_S(48,	"sendmsg_zc")
+

_service:tar_scm:audit-3.0.9.tar.gz/m4/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/m4/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/m4/cap-ng.m4 -> _service:tar_scm:audit-3.1.1.tar.gz/m4/cap-ng.m4 Changed

_service:tar_scm:audit-3.0.9.tar.gz/rules/30-ospp-v42.rules -> _service:tar_scm:audit-3.1.1.tar.gz/rules/30-ospp-v42.rules Changed

_service:tar_scm:audit-3.0.9.tar.gz/rules/30-pci-dss-v31.rules -> _service:tar_scm:audit-3.1.1.tar.gz/rules/30-pci-dss-v31.rules Changed

_service:tar_scm:audit-3.0.9.tar.gz/rules/30-stig.rules -> _service:tar_scm:audit-3.1.1.tar.gz/rules/30-stig.rules Changed

_service:tar_scm:audit-3.0.9.tar.gz/rules/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/rules/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/src/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/auditctl-listing.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/auditctl-listing.c Changed

@@ -1,5 +1,5 @@
 /* auditctl-listing.c --
- * Copyright 2014,16,2021 Red Hat Inc.
+ * Copyright 2014,16,2021-2 Red Hat Inc.
  * All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -25,11 +25,18 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#ifdef WITH_IO_URING
+#include <linux/io_uring.h>
+#endif
 #include "auditctl-listing.h"
 #include "private.h"
 #include "auditctl-llist.h"
 #include "auparse-idata.h"
 
+#ifndef IORING_OP_LAST
+#define IORING_OP_LAST 37
+#endif
+
 /* Global vars */
 static llist l;
 static int printed;
@@ -135,18 +142,24 @@
 {
 	int count = 0;
 	int all = 1;
-	unsigned int i;
+	unsigned int i, len;
 	int machine = audit_detect_machine();
 
 	/* Rules on the following filters do not take a syscall */
 	if (((r->flags & AUDIT_FILTER_MASK) == AUDIT_FILTER_USER) ||
 	    ((r->flags & AUDIT_FILTER_MASK) == AUDIT_FILTER_TASK) ||
-	    ((r->flags &AUDIT_FILTER_MASK) == AUDIT_FILTER_EXCLUDE) ||
-	    ((r->flags &AUDIT_FILTER_MASK) == AUDIT_FILTER_FS))
+	    ((r->flags & AUDIT_FILTER_MASK) == AUDIT_FILTER_EXCLUDE) ||
+	    ((r->flags & AUDIT_FILTER_MASK) == AUDIT_FILTER_FS))
 		return 0;
 
+	int io_uring=(r->flags & AUDIT_FILTER_MASK) == AUDIT_FILTER_URING_EXIT;
+	if (io_uring)
+		len = IORING_OP_LAST;
+	else
+		len = AUDIT_BITMASK_SIZE-1;
+
 	/* See if its all or specific syscalls */
-	for (i = 0; i < (AUDIT_BITMASK_SIZE-1); i++) {
+	for (i = 0; i < len; i++) {
 		if (r->maski != (uint32_t)~0) {
 			all = 0;
 			break;
@@ -156,25 +169,43 @@
 	if (all) {
 		printf(" -S all");
 		count = i;
-	} else for (i = 0; i < AUDIT_BITMASK_SIZE * 32; i++) {
-		int word = AUDIT_WORD(i);
-		int bit  = AUDIT_BIT(i);
-		if (r->maskword & bit) {
-			const char *ptr;
-			if (_audit_elf)
-				machine = audit_elf_to_machine(_audit_elf);
-			if (machine < 0)
-				ptr = NULL;
-			else
-				ptr = audit_syscall_to_name(i, machine);
-			if (!count)
-				printf(" -S ");
-			if (ptr)
-				printf("%s%s", !count ? "" : ",", ptr);
-			else
-				printf("%s%u", !count ? "" : ",", i);
-			count++;
-			*sc = i;
+	} else if (io_uring) {
+		for (i = 0; i < IORING_OP_LAST; i++) {
+			int word = AUDIT_WORD(i);
+			int bit  = AUDIT_BIT(i);
+			if (r->maskword & bit) {
+				const char *ptr = audit_uringop_to_name(i);
+				if (!count)
+					printf(" -S ");
+				if (ptr)
+					printf("%s%s", !count ? "" : ",", ptr);
+				else
+					printf("%s%u", !count ? "" : ",", i);
+				count++;
+				*sc = i;
+			}
+		}
+	} else {
+		for (i = 0; i < AUDIT_BITMASK_SIZE * 32; i++) {
+			int word = AUDIT_WORD(i);
+			int bit  = AUDIT_BIT(i);
+			if (r->maskword & bit) {
+				const char *ptr;
+				if (_audit_elf)
+				    machine = audit_elf_to_machine(_audit_elf);
+				if (machine < 0)
+					ptr = NULL;
+				else
+					ptr = audit_syscall_to_name(i, machine);
+				if (!count)
+					printf(" -S ");
+				if (ptr)
+					printf("%s%s", !count ? "" : ",", ptr);
+				else
+					printf("%s%u", !count ? "" : ",", i);
+				count++;
+				*sc = i;
+			}
 		}
 	}
 	return count;

_service:tar_scm:audit-3.0.9.tar.gz/src/auditctl.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/auditctl.c Changed

@@ -1,5 +1,5 @@
-/* auditctl.c -- 
- * Copyright 2004-2017,2020 Red Hat Inc.
+/* auditctl.c --
+ * Copyright 2004-2017,202-3 Red Hat Inc.
  * All Rights Reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -153,18 +153,10 @@
 
 static int lookup_filter(const char *str, int *filter)
 {
-	if (strcmp(str, "exit") == 0)
-		*filter = AUDIT_FILTER_EXIT;
-	else if (strcmp(str, "task") == 0)
-		*filter = AUDIT_FILTER_TASK;
-	else if (strcmp(str, "user") == 0)
-		*filter = AUDIT_FILTER_USER;
-	else if (strcmp(str, "exclude") == 0) {
-		*filter = AUDIT_FILTER_EXCLUDE;
+	*filter = audit_name_to_flag(str);
+	if (*filter == AUDIT_FILTER_EXCLUDE)
 		exclude = 1;
-	} else if (strcmp(str, "filesystem") == 0)
-		*filter = AUDIT_FILTER_FS;
-	else
+	if (*filter == -1)
 		return 2;
 	return 0;
 }
@@ -421,15 +413,20 @@
 	FD_ZERO(&read_mask);
 	FD_SET(fd, &read_mask);
 
-	if (strcasecmp(optarg, "TERM") == 0)
+	if (strcasecmp(optarg, "TERM") == 0 ||
+	    strcasecmp(optarg, "stop") == 0)
 		signal = SIGTERM;
-	else if (strcasecmp(optarg, "HUP") == 0)
+	else if (strcasecmp(optarg, "HUP") == 0 ||
+		 strcasecmp(optarg, "reload") == 0)
 		signal = SIGHUP;
-	else if (strcasecmp(optarg, "USR1") == 0)
+	else if (strcasecmp(optarg, "USR1") == 0 ||
+		 strcasecmp(optarg, "rotate") == 0)
 		signal = SIGUSR1;
-	else if (strcasecmp(optarg, "USR2") == 0)
+	else if (strcasecmp(optarg, "USR2") == 0 ||
+		 strcasecmp(optarg, "resume") == 0)
 		signal = SIGUSR2;
-	else if (strcasecmp(optarg, "CONT") == 0)
+	else if (strcasecmp(optarg, "CONT") == 0 ||
+		 strcasecmp(optarg, "state") == 0)
 		signal = SIGCONT;
 
 	if (signal == 0) {
@@ -541,6 +538,29 @@
 	return audit_rule_syscallbyname_data(rule_new, optarg);
 }
 
+#ifdef WITH_IO_URING
+// return 0 on success and -1 if unknow op.
+static int parse_io_uring(const char *optarg)
+{
+	if (strchr(optarg, ',')) {
+		int retval;
+		char *saved, *ptr, *tmp = strdup(optarg);
+		if (tmp == NULL)
+			return -1;
+		ptr = strtok_r(tmp, ",", &saved);
+		while (ptr) {
+			retval = audit_rule_io_uringbyname_data(rule_new, ptr);
+			if (retval != 0)
+				break;
+			ptr = strtok_r(NULL, ",", &saved);
+		}
+		free(tmp);
+		return retval;
+	}
+	return audit_rule_io_uringbyname_data(rule_new, optarg);
+}
+#endif
+
 static struct option long_opts =
 {
 #if HAVE_DECL_AUDIT_FEATURE_VERSION == 1
@@ -782,6 +802,29 @@
 		break;
         case 'S': {
 		int unknown_arch = !_audit_elf;
+#ifdef WITH_IO_URING
+		if (((add & (AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
+				AUDIT_FILTER_URING_EXIT || (del &
+				(AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
+				AUDIT_FILTER_URING_EXIT)) {
+			// Do io_uring op
+			rc = parse_io_uring(optarg);
+			switch (rc)
+			{
+				case 0:
+					_audit_syscalladded = 1;
+					retval = 1; /* success - please send */
+					break;
+				case -1:
+					audit_msg(LOG_ERR,
+						  "io_uring op unknown: %s",
+						  optarg);
+				retval = -1;
+				break;
+			}
+			break;
+		}
+#endif
 		/* Do some checking to make sure that we are not adding a
 		 * syscall rule to a list that does not make sense. */
 		if (((add & (AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==

_service:tar_scm:audit-3.0.9.tar.gz/src/auditd-config.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/auditd-config.c Changed

@@ -1,24 +1,23 @@
-/* auditd-config.c -- 
+/* auditd-config.c --
  * Copyright 2004-2011,2013-14,2016,2018,2020-21 Red Hat Inc.
  * All Rights Reserved.
+
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
+ * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  * Authors:
  *   Steve Grubb <sgrubb@redhat.com>
- *
  */
 
 #include "config.h"
@@ -1844,7 +1843,7 @@
 		config->plugin_dir = malloc(len + 2);
 		if (config->plugin_dir) {
 			strcpy(config->plugin_dir, nv->value);
-			if (config->plugin_dirlen - 1 != '/')
+			if (len > 1 && config->plugin_dirlen - 1 != '/')
 				config->plugin_dirlen = '/';
 			config->plugin_dirlen + 1 = 0;
 		}

_service:tar_scm:audit-3.0.9.tar.gz/src/auditd-config.h -> _service:tar_scm:audit-3.1.1.tar.gz/src/auditd-config.h Changed

@@ -1,24 +1,23 @@
 /* auditd-config.h -- 
- * Copyright 2004-2009,2014,2016,2018 Red Hat Inc., Durham, North Carolina.
+ * Copyright 2004-2009,2014,2016,2018 Red Hat Inc.
  * All Rights Reserved.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
  *
- * This program is distributed in the hope that it will be useful,
+ * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  * Authors:
  *   Steve Grubb <sgrubb@redhat.com>
- * 
  */
 
 #ifndef AUDITD_CONFIG_H

_service:tar_scm:audit-3.0.9.tar.gz/src/auditd-event.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/auditd-event.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/auditd-listen.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/auditd-listen.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/auditd.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/auditd.c Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/ausearch-llist.h -> _service:tar_scm:audit-3.1.1.tar.gz/src/ausearch-llist.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/ausearch-parse.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/ausearch-parse.c Changed

@@ -92,6 +92,7 @@
 		do {
 			switch (n->type) {
 			case AUDIT_SYSCALL:
+			case AUDIT_URINGOP:
 				ret = parse_syscall(n, s);
 				break;
 			case AUDIT_CWD:
@@ -147,6 +148,7 @@
 				break;
 			case AUDIT_FEATURE_CHANGE:
 			case AUDIT_ANOM_LINK:
+			case AUDIT_DM_CTRL:
 				ret = parse_task_info(n, s);
 				break;
 			case AUDIT_SECCOMP:
@@ -176,6 +178,7 @@
 			case AUDIT_PROCTITLE:
 			case AUDIT_REPLACE...AUDIT_BPF:
 			case AUDIT_OPENAT2:
+			case AUDIT_DM_EVENT:
 				// Nothing to parse
 				break;
 			case AUDIT_NETFILTER_CFG:
@@ -508,7 +511,8 @@
 	int ret;
 
 	term = n->message;
-	if (report_format > RPT_DEFAULT || event_machine != -1) {
+	if ((report_format > RPT_DEFAULT || event_machine != -1) &&
+	    n->type == AUDIT_SYSCALL) {
 		// get arch
 		str = strstr(term, "arch=");
 		if (str == NULL) 
@@ -525,7 +529,13 @@
 		*term = ' ';
 	} 
 	// get syscall
-	str = strstr(term, "syscall=");
+	if (n->type == AUDIT_SYSCALL)
+		str = strstr(term, "syscall=");
+	else if (n->type == AUDIT_URINGOP) { // or uring_op
+		str = strstr(term, "uring_op=");
+		s->arch = MACH_IO_URING;
+	} else
+		str = NULL; // unimplemented type
 	if (str == NULL)
 		return 4;
 	ptr = str + 8;
@@ -571,36 +581,38 @@
 		s->exit_is_set = 1;
 		*term = ' ';
 	}
-	// get a0
-	str = strstr(term, "a0=");
-	if (str == NULL)
-		return 11;
-	ptr = str + 3;
-	term = strchr(ptr, ' ');
-	if (term == NULL)
-		return 12;
-	*term = 0;
-	errno = 0;
-	// 64 bit dump on 32 bit machine looks bad here - need long long
-	n->a0 = strtoull(ptr, NULL, 16); // Hex
-	if (errno)
-		return 13;
-	*term = ' ';
-	// get a1
-	str = strstr(term, "a1=");
-	if (str == NULL)
-		return 11;
-	ptr = str + 3;
-	term = strchr(ptr, ' ');
-	if (term == NULL)
-		return 12;
-	*term = 0;
-	errno = 0;
-	// 64 bit dump on 32 bit machine looks bad here - need long long
-	n->a1 = strtoull(ptr, NULL, 16); // Hex
-	if (errno)
-		return 13;
-	*term = ' ';
+	if (n->type == AUDIT_SYSCALL) {
+		// get a0
+		str = strstr(term, "a0=");
+		if (str == NULL)
+			return 11;
+		ptr = str + 3;
+		term = strchr(ptr, ' ');
+		if (term == NULL)
+			return 12;
+		*term = 0;
+		errno = 0;
+		// 64 bit dump on 32 bit machine looks bad here - need long long
+		n->a0 = strtoull(ptr, NULL, 16); // Hex
+		if (errno)
+			return 13;
+		*term = ' ';
+		// get a1
+		str = strstr(term, "a1=");
+		if (str == NULL)
+			return 11;
+		ptr = str + 3;
+		term = strchr(ptr, ' ');
+		if (term == NULL)
+			return 12;
+		*term = 0;
+		errno = 0;
+		// 64 bit dump on 32 bit machine looks bad here - need long long
+		n->a1 = strtoull(ptr, NULL, 16); // Hex
+		if (errno)
+			return 13;
+		*term = ' ';
+	}
 
 	ret = parse_task_info(n, s);
 	if (ret)
@@ -1164,7 +1176,8 @@
 			saved = *term;
 			*term = 0;
 			ptr++;
-			s->acct = strdup(ptr);
+			if (!s->acct) //fuzzer induced duplicate
+				s->acct = strdup(ptr);
 			*term = saved;
 		} else { 
 			/* Handle legacy accts */

_service:tar_scm:audit-3.0.9.tar.gz/src/ausearch-report.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/ausearch-report.c Changed

@@ -1,6 +1,6 @@
 /*
 * ausearch-report.c - Format and output events
-* Copyright (c) 2005-09,2011-13,2016-17,2021 Red Hat
+* Copyright (c) 2005-09,2011-13,2016-17,2021-23 Red Hat
 * All Rights Reserved.
 *
 * This software may be freely redistributed and/or modified under the
@@ -343,8 +343,11 @@
 	}
 	type = auparse_interp_adjust_type(rtype, name, val);
 
-	if (rtype == AUDIT_SYSCALL || rtype == AUDIT_SECCOMP) {
-		if (machine == (unsigned long)-1) 
+	if (rtype == AUDIT_SYSCALL || rtype == AUDIT_SECCOMP ||
+	    rtype == AUDIT_URINGOP) {
+		if (rtype == AUDIT_URINGOP)
+			machine = MACH_IO_URING;
+		else if (machine == (unsigned long)-1)
 			machine = audit_detect_machine();
 		if (*name == 'a' && strcmp(name, "arch") == 0) {
 			unsigned long ival;
@@ -356,8 +359,9 @@
 			}
 			machine = audit_elf_to_machine(ival);
 		}
-		if (cur_syscall < 0 && *name == 's' &&
-				strcmp(name, "syscall") == 0) {
+		if (cur_syscall < 0 && ((*name == 's' &&
+				strcmp(name, "syscall") == 0) ||
+		    (*name == 'u' && strcmp(name, "uring_op") == 0))) {
 			unsigned long ival;
 			errno = 0;
 			ival = strtoul(val, NULL, 10);
@@ -370,6 +374,7 @@
 		id.syscall = cur_syscall;
 	} else
 		id.syscall = 0;
+
 	id.machine = machine;
 	id.a0 = a0;
 	id.a1 = a1;

_service:tar_scm:audit-3.0.9.tar.gz/src/ausearch-time.c -> _service:tar_scm:audit-3.1.1.tar.gz/src/ausearch-time.c Changed

@@ -46,6 +46,7 @@
 static struct nv_pair timetab = {
         { T_NOW, "now" },
         { T_RECENT, "recent" },
+	{ T_THIS_HOUR, "this-hour" },
 	{ T_BOOT, "boot" },
         { T_TODAY, "today" },
         { T_YESTERDAY, "yesterday" },
@@ -85,6 +86,8 @@
         t->tm_mday = 0;        /* day of the month */
         t->tm_mon = 0;         /* month */
         t->tm_year = 0;        /* year */
+	t->tm_wday = 0;	       /* not used */
+	t->tm_yday = 0;        /* not used */
         t->tm_isdst = 0;       /* DST flag */
 }
 
@@ -124,6 +127,15 @@
 	replace_date(d, tv);
 }
 
+static void set_tm_hour(struct tm *d)
+{
+        time_t t = time(NULL);
+        struct tm *tv = localtime(&t);
+        d->tm_sec = 0;          /* seconds */
+        d->tm_min = 0;          /* minutes */
+	replace_time(d, tv);
+}
+
 static int set_tm_boot(struct tm *d)
 {
 	char buf128;
@@ -244,6 +256,9 @@
 			case T_RECENT:
 				set_tm_recent(d);
 				break;
+			case T_THIS_HOUR:
+				set_tm_hour(d);
+				break;
 			case T_BOOT:
 				if (set_tm_boot(d))
 					return -2;
@@ -302,7 +317,7 @@
 		} else {
 			int keyword=lookup_time(da);
 			if (keyword == T_RECENT || keyword == T_NOW ||
-				keyword == T_BOOT) {
+				keyword == T_THIS_HOUR || keyword == T_BOOT) {
 				if (ti == NULL || strcmp(ti, "00:00:00") == 0)
 					goto set_it;
 			}
@@ -376,7 +391,7 @@
 		} else {
 			int keyword=lookup_time(da);
 			if (keyword == T_RECENT || keyword == T_NOW ||
-				keyword == T_BOOT) {
+				keyword == T_THIS_HOUR || keyword == T_BOOT) {
 				if (ti == NULL || strcmp(ti, "00:00:00") == 0)
 					goto set_it;
 			}

_service:tar_scm:audit-3.0.9.tar.gz/src/ausearch-time.h -> _service:tar_scm:audit-3.1.1.tar.gz/src/ausearch-time.h Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/libev/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/src/libev/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/src/test/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/src/test/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/tools/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/tools/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/tools/aulast/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/tools/aulast/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/tools/aulastlog/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/tools/aulastlog/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/tools/ausyscall/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/tools/ausyscall/Makefile.in Changed

_service:tar_scm:audit-3.0.9.tar.gz/tools/ausyscall/ausyscall.8 -> _service:tar_scm:audit-3.1.1.tar.gz/tools/ausyscall/ausyscall.8 Changed

@@ -1,4 +1,4 @@
-.TH AUSYSCALL "8" "Nov 2008" "Red Hat" "System Administration Utilities"
+.TH AUSYSCALL "8" "Feb 2023" "Red Hat" "System Administration Utilities"
 .SH NAME
 ausyscall \- a program that allows mapping syscall names and numbers
 .SH SYNOPSIS
@@ -6,6 +6,10 @@
 .SH DESCRIPTION
 \fBausyscall\fP is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname \-m`. If arch is not given, the program will take a guess based on the running image. Or for convenience, you can pass \fBb32\fP or \fBb64\fP to use the current arch but a specific ABI. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the \-\-dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the \-\-exact flag and it will do an exact string match.
 
+The program takes the special arch,
+.B uring,
+to denote that you want to specify io_uring operations. In this case, the arch must be given because it will otherwise detect the underlying harware.
+
 This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule:
 
 .B \-a always, exit \-S open \-F exit=\-EPERM \-k fail\-open

_service:tar_scm:audit-3.0.9.tar.gz/tools/ausyscall/ausyscall.c -> _service:tar_scm:audit-3.1.1.tar.gz/tools/ausyscall/ausyscall.c Changed

@@ -1,6 +1,6 @@
 /*
- * ausysvcall.c - A program that lets you map syscall names and numbers 
- * Copyright (c) 2008 Red Hat Inc., Durham, North Carolina.
+ * ausysvcall.c - A program that lets you map syscall names and numbers
+ * Copyright (c) 2008,2022 Red Hat Inc.
  * All Rights Reserved.
  *
  * This software may be freely redistributed and/or modified under the
@@ -15,7 +15,7 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; see the file COPYING. If not, write to the
- * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
  * Boston, MA 02110-1335, USA.
  *
  * Authors:
@@ -32,8 +32,8 @@
 
 void usage(void)
 {
-	fprintf(stderr, "usage: ausyscall arch name | number | --dump | --exact\n");
-	exit(1);
+  fprintf(stderr, "usage: ausyscall arch name | number | --dump | --exact\n");
+  exit(1);
 }
 
 int main(int argc, char *argv)
@@ -93,6 +93,11 @@
 			name = argvi;
 		}
 	}
+	// If they passed only uring, assume they want the syscall
+	if (name == NULL && machine == MACH_IO_URING && i == 2) {
+		machine = -1;
+		name = argvi - 1;
+	}
 	if (machine == -1)
 		machine = audit_detect_machine();
 	if (machine == -1) {
@@ -105,7 +110,7 @@
 			audit_machine_to_name(machine));
 		for (i=0; i<8192; i++) {
 			name = audit_syscall_to_name(i, machine);
-			if (name) 
+			if (name)
 				printf("%d\t%s\n", i, name);
 		}
 		return 0;
@@ -116,7 +121,7 @@
 			rc = audit_name_to_syscall(name, machine);
 			if (rc < 0) {
 				fprintf(stderr,
-					"Unknown syscall %s using %s lookup table\n",
+				   "Unknown syscall %s using %s lookup table\n",
 					name, audit_machine_to_name(machine));
 				return 1;
 			} else
@@ -124,7 +129,7 @@
 		} else {
 			int found = 0;
 			for (i=0; i< LAST_SYSCALL; i++) {
-				const char *n = audit_syscall_to_name(i, machine);
+				const char *n=audit_syscall_to_name(i, machine);
 				if (n && strcasestr(n, name)) {
 					found = 1;
 					printf("%-18s %d\n", n, i);
@@ -132,7 +137,7 @@
 			}
 			if (!found) {
 				fprintf(stderr,
-					"Unknown syscall %s using %s lookup table\n",
+				   "Unknown syscall %s using %s lookup table\n",
 					name, audit_machine_to_name(machine));
 				return 1;
 			}

_service:tar_scm:audit-3.0.9.tar.gz/tools/auvirt/Makefile.in -> _service:tar_scm:audit-3.1.1.tar.gz/tools/auvirt/Makefile.in Changed

Changes of Revision 9