Summary: User space tools for kernel auditing Name: audit Version: 4.1.0 Release: 3%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: https://github.com/linux-audit/audit-userspace/ Source0: audit-userspace-%{version}.tar.gz Source1: https://www.gnu.org/licenses/lgpl-2.1.txt BuildRequires: make gcc BuildRequires: autoconf automake libtool BuildRequires: kernel-headers >= 5.0 BuildRequires: systemd Requires: %{name}-libs%{?_isa} = %{version}-%{release} Requires: %{name}-rules%{?_isa} = %{version}-%{release} Requires(post): systemd coreutils Requires(preun): systemd Requires(postun): systemd coreutils Recommends: initscripts-service # Placing this here under the assumption that anything using the # python libraries expects the system to have an audit daemon Obsoletes: python2-audit < %{version}-%{release} %description The audit package contains the user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux 2.6 and later kernels. It includes example rules that you can use. %package libs Summary: Dynamic library for libaudit License: LGPL-2.0-or-later BuildRequires: libcap-ng-devel %description libs The audit-libs package contains the dynamic libraries needed for applications to use the audit framework. %package libs-devel Summary: Header files for libaudit License: LGPL-2.0-or-later Requires: %{name}-libs%{?_isa} = %{version}-%{release} Requires: kernel-headers >= 5.0 %description libs-devel The audit-libs-devel package contains the header files needed for developing applications that need to use the audit framework libraries. %package -n python3-audit Summary: Python3 bindings for libaudit License: LGPL-2.0-or-later BuildRequires: python3-devel python-unversioned-command swig Requires: %{name}-libs%{?_isa} = %{version}-%{release} Provides: audit-libs-python3 = %{version}-%{release} Provides: audit-libs-python3%{?_isa} = %{version}-%{release} Obsoletes: audit-libs-python3 < %{version}-%{release} %description -n python3-audit The python3-audit package contains the bindings so that libaudit and libauparse can be used by python3. %package -n audispd-plugins Summary: Plugins for the audit event dispatcher License: GPL-2.0-or-later BuildRequires: krb5-devel libcap-ng-devel Requires: %{name}%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description -n audispd-plugins The audispd-plugins package provides plugins for the real-time interface to the audit system, audispd. These plugins can do things like relay events to remote machines. %package -n audispd-plugins-zos Summary: z/OS plugin for the audit event dispatcher License: GPL-2.0-or-later BuildRequires: openldap-devel libcap-ng-devel Requires: %{name}%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description -n audispd-plugins-zos The audispd-plugins-zos package provides a plugin that will forward all incoming audit events, as they happen, to a configured z/OS SMF (Service Management Facility) database, through an IBM Tivoli Directory Server (ITDS) set for Remote Audit service. %package rules Summary: audit rules and utilities License: GPL-2.0-or-later Requires(post): coreutils Requires: %{name}-libs%{?_isa} = %{version}-%{release} Recommends: %{name} = %{version}-%{release} %description rules The audit rules package contains the rules and utilities to load audit rules. %prep %setup -q -n %{name}-userspace-%{version} cp %{SOURCE1} . %build autoreconf -fv --install # Remove the ids code, its not ready sed -i 's/ ids / /' audisp/plugins/Makefile.am sed -i 's/ ids / /' audisp/plugins/Makefile.in %configure --with-python3=yes \ --enable-gssapi-krb5=yes --with-arm --with-aarch64 --with-riscv \ --with-libcap-ng=yes --without-golang --enable-zos-remote \ --with-io_uring --enable-experimental --with-nftables make CFLAGS="%{optflags}" %{?_smp_mflags} %install mkdir -p $RPM_BUILD_ROOT/{sbin,etc/audit/plugins.d,etc/audit/rules.d} mkdir -p $RPM_BUILD_ROOT/%{_mandir}/{man5,man8} mkdir -p $RPM_BUILD_ROOT/%{_libdir}/audit mkdir -p --mode=0700 $RPM_BUILD_ROOT/%{_var}/log/audit mkdir -p $RPM_BUILD_ROOT/%{_var}/spool/audit make DESTDIR=$RPM_BUILD_ROOT install # Remove these items so they don't get picked up. rm -f $RPM_BUILD_ROOT/%{_libdir}/libaudit.a rm -f $RPM_BUILD_ROOT/%{_libdir}/libauparse.a rm -f $RPM_BUILD_ROOT/%{_libdir}/libauplugin.a find $RPM_BUILD_ROOT -name '*.la' -delete find $RPM_BUILD_ROOT/%{_libdir}/python%{python3_version}/site-packages -name '*.a' -delete || true # On platforms with 32 & 64 bit libs, we need to coordinate the timestamp touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz %check make check # Get rid of make files so that they don't get packaged. rm -f rules/Makefile* %post %systemd_post auditd.service # Do not perform service start/restart when running during an rpm-ostree compose if [ -f /run/ostree-booted ] ; then exit 0 fi # If an upgrade, restart it if it's running if [ $1 -eq 2 ] ; then state=$(systemctl show -P ActiveState auditd) if [ $state = "active" ] ; then auditctl --signal stop || true systemctl start auditd || true fi # if an install, start it since preset says we should be running elif [ $1 -eq 1 ] ; then systemctl start auditd || true fi %post rules %systemd_post audit-rules.service # Copy default rules into place on new installation files=`ls /etc/audit/rules.d/ 2>/dev/null | wc -w` if [ "$files" -eq 0 ] ; then echo "No rules detected, adding default" %if 0%{?rhel} if [ -e %{_datadir}/%{name}-rules/10-base-config.rules ] ; then install -m 0640 -o 0 -g 0 -p %{_datadir}/%{name}-rules/10-base-config.rules /etc/audit/rules.d/audit.rules %else # FESCO asked for audit to be off by default. #1117953 if [ -e %{_datadir}/%{name}-rules/10-no-audit.rules ] ; then install -m 0640 -o 0 -g 0 -p %{_datadir}/%{name}-rules/10-no-audit.rules /etc/audit/rules.d/audit.rules %endif else install -m 0640 -o 0 -g 0 /dev/null /etc/audit/rules.d/audit.rules fi # Only load the new rules if not running during an rpm-ostree compose if [ ! -f /run/ostree-booted ] ; then # Make the new rules active augenrules --load || true fi fi %preun %systemd_preun auditd.service # If uninstalling, stop it if [ $1 -eq 0 ] ; then auditctl --signal stop || true fi %preun rules %systemd_preun audit-rules.service # If uninstalling, delete the rules loaded in the kernel if [ $1 -eq 0 ] ; then auditctl -D > /dev/null 2>&1 || true fi %files libs %{!?_licensedir:%global license %%doc} %license lgpl-2.1.txt %{_libdir}/libaudit.so.1* %{_libdir}/libauparse.* %{_libdir}/libauplugin.so.1* %config(noreplace) %attr(640,root,root) /etc/libaudit.conf %{_mandir}/man5/libaudit.conf.5.gz %files libs-devel %doc contrib/plugin %{_libdir}/libaudit.so %{_libdir}/libauparse.so %{_libdir}/libauplugin.so %{_includedir}/libaudit.h %{_includedir}/audit_logging.h %{_includedir}/audit-records.h %{_includedir}/auparse.h %{_includedir}/auparse-defs.h %{_includedir}/auplugin.h %{_datadir}/aclocal/audit.m4 %{_libdir}/pkgconfig/audit.pc %{_libdir}/pkgconfig/auparse.pc %{_mandir}/man3/* %{_mandir}/man5/ausearch-expression.5.gz %files -n python3-audit %attr(755,root,root) %{python3_sitearch}/* %files %doc README.md ChangeLog init.d/auditd.cron %{!?_licensedir:%global license %%doc} %license COPYING %attr(644,root,root) %{_mandir}/man8/auditd.8.gz %attr(644,root,root) %{_mandir}/man8/aureport.8.gz %attr(644,root,root) %{_mandir}/man8/ausearch.8.gz %attr(644,root,root) %{_mandir}/man8/aulast.8.gz %attr(644,root,root) %{_mandir}/man8/aulastlog.8.gz %attr(644,root,root) %{_mandir}/man8/ausyscall.8.gz %attr(644,root,root) %{_mandir}/man5/auditd.conf.5.gz %attr(644,root,root) %{_mandir}/man5/auditd.cron.5.gz %attr(644,root,root) %{_mandir}/man5/auditd-plugins.5.gz %attr(755,root,root) %{_sbindir}/auditd %attr(755,root,root) %{_sbindir}/ausearch %attr(755,root,root) %{_sbindir}/aureport %attr(755,root,root) %{_bindir}/aulast %attr(755,root,root) %{_bindir}/aulastlog %attr(755,root,root) %{_bindir}/ausyscall %attr(644,root,root) %{_unitdir}/auditd.service %attr(640,root,root) %{_tmpfilesdir}/audit.conf %attr(750,root,root) %dir %{_libexecdir}/initscripts/legacy-actions/auditd %attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/condrestart %attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/reload %attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/restart %attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/resume %attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/rotate %attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/state %attr(750,root,root) %{_libexecdir}/initscripts/legacy-actions/auditd/stop %ghost %{_localstatedir}/run/auditd.state %attr(-,root,-) %dir %{_var}/log/audit %attr(750,root,root) %dir /etc/audit/plugins.d %config(noreplace) %attr(640,root,root) /etc/audit/auditd.conf %files rules %attr(755,root,root) %dir %{_datadir}/%{name}-rules %attr(644,root,root) %{_datadir}/%{name}-rules/* %attr(644,root,root) %{_mandir}/man8/auditctl.8.gz %attr(644,root,root) %{_mandir}/man8/augenrules.8.gz %attr(644,root,root) %{_mandir}/man7/audit.rules.7.gz %attr(755,root,root) %{_sbindir}/auditctl %attr(755,root,root) %{_sbindir}/augenrules %attr(644,root,root) %{_unitdir}/audit-rules.service %attr(750,root,root) %dir /etc/audit %attr(750,root,root) %dir /etc/audit/rules.d %ghost %config(noreplace) %attr(640,root,root) /etc/audit/rules.d/audit.rules %ghost %config(noreplace) %attr(640,root,root) /etc/audit/audit.rules %config(noreplace) %attr(640,root,root) /etc/audit/audit-stop.rules %files -n audispd-plugins %config(noreplace) %attr(640,root,root) /etc/audit/audisp-remote.conf %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-remote.conf %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/syslog.conf %config(noreplace) %attr(640,root,root) /etc/audit/audisp-statsd.conf %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/au-statsd.conf %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/af_unix.conf %config(noreplace) %attr(640,root,root) /etc/audit/audisp-filter.conf %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/filter.conf %attr(750,root,root) %{_sbindir}/audisp-remote %attr(750,root,root) %{_sbindir}/audisp-syslog %attr(750,root,root) %{_sbindir}/audisp-af_unix %attr(750,root,root) %{_sbindir}/audisp-statsd %attr(750,root,root) %{_sbindir}/audisp-filter %attr(700,root,root) %dir %{_var}/spool/audit %attr(644,root,root) %{_mandir}/man5/audisp-remote.conf.5.gz %attr(644,root,root) %{_mandir}/man8/audisp-remote.8.gz %attr(644,root,root) %{_mandir}/man8/audisp-syslog.8.gz %attr(644,root,root) %{_mandir}/man8/audisp-af_unix.8.gz %attr(644,root,root) %{_mandir}/man8/audisp-statsd.8.gz %attr(644,root,root) %{_mandir}/man8/audisp-filter.8.gz %files -n audispd-plugins-zos %attr(644,root,root) %{_mandir}/man8/audispd-zos-remote.8.gz %attr(644,root,root) %{_mandir}/man5/zos-remote.conf.5.gz %config(noreplace) %attr(640,root,root) /etc/audit/plugins.d/audispd-zos-remote.conf %config(noreplace) %attr(640,root,root) /etc/audit/zos-remote.conf %attr(750,root,root) %{_sbindir}/audispd-zos-remote %changelog * Fri Jul 25 2025 Steve Grubb 4.1.0-3 - Attempt correcting install with no systemd (#2380048) * Wed Jul 23 2025 Fedora Release Engineering - 4.1.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Jul 10 2025 Steve Grubb 4.1.0-1 - New upstream release * Thu Jun 26 2025 Steve Grubb 4.0.5-2 - Apply audit-4.0.5-af_unix.patch (#2375024) * Wed Jun 11 2025 Steve Grubb 4.0.5-1 - New upstream release * Mon Jun 02 2025 Python Maint - 4.0.4-3 - Rebuilt for Python 3.14 * Sat May 31 2025 Steve Grubb 4.0.4-2 - Fix missing delete commang in auditctl * Wed May 28 2025 Steve Grubb 4.0.4-1 - New upstream release * Thu Jan 16 2025 Fedora Release Engineering - 4.0.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Tue Jan 07 2025 Steve Grubb 4.0.3-1 - New upstream release * Thu Aug 08 2024 Steve Grubb 4.0.2-1 - New upstream release * Wed Jul 17 2024 Fedora Release Engineering - 4.0.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Fri Jun 07 2024 Python Maint - 4.0.1-3 - Rebuilt for Python 3.13 * Mon May 20 2024 Steve Grubb 4.0.1-2 - Make the modes on audit rules match spec file. * Mon Mar 11 2024 Steve Grubb 4.0.1-1 - New upstream release * Sun Feb 04 2024 Timothée Ravier - 4.0-8 - Fix 'install' calls in post scriptlet * Thu Jan 25 2024 Steve Grubb 4.0-7 - Don't do "live" operations during rpm-ostree composes * Wed Jan 24 2024 Steve Grubb 4.0-5 - Auditd is stopping during upgrade (bz 2259610) * Mon Jan 22 2024 Fedora Release Engineering - 4.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Fri Jan 19 2024 Fedora Release Engineering - 4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Tue Jan 16 2024 Steve Grubb 4.0-1 - New upstream major release * Sat Nov 04 2023 Steve Grubb 3.1.2-5 - Bug fixes pulled from upstrean * Wed Sep 13 2023 Dusty Mabe 3.1.2-4 - Remove initscripts-service from Requires(postun) * Fri Sep 01 2023 Steve Grubb 3.1.2-3 - Change initscrips-service to a Recommends * Sat Aug 26 2023 Steve Grubb 3.1.2-2 - SPDX Migration * Sun Aug 06 2023 Steve Grubb 3.1.2-1 - New upstream release * Wed Jul 19 2023 Fedora Release Engineering - 3.1.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Tue Jun 13 2023 Python Maint - 3.1.1-3 - Rebuilt for Python 3.12 * Tue May 09 2023 Davide Cavalca 3.1.1-2 - Install the base ruleset on RHEL * Thu Apr 27 2023 Steve Grubb 3.1.1-1 - New upstream release * Thu Feb 09 2023 Steve Grubb 3.1-2 - New upstream feature release * Wed Jan 18 2023 Fedora Release Engineering - 3.0.9-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild * Thu Dec 22 2022 Steve Grubb 3.0.9-2 - BuildRequires python-setuptools - SPDX Migration * Mon Aug 29 2022 Steve Grubb 3.0.9-1 - New upstream bugfix release * Wed Jul 20 2022 Fedora Release Engineering - 3.0.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Mon Jun 13 2022 Python Maint - 3.0.8-2 - Rebuilt for Python 3.11 * Tue Mar 29 2022 Steve Grubb 3.0.8-1 - New upstream bugfix release * Thu Feb 24 2022 Steve Grubb 3.0.7-3 - Undo fix to libaudit.h before installing * Mon Feb 14 2022 Steve Grubb 3.0.7-2 - Adjust sample-rules dir permissions - Add support for new access/dealloc function attributes - Adjust compile flags for less warnings * Sun Jan 23 2022 Steve Grubb 3.0.7-1 - New upstream bugfix and feature release * Wed Jan 19 2022 Fedora Release Engineering - 3.0.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild * Wed Jan 05 2022 Steve Grubb 3.0.6-2 - Require initscripts-service instead of initscripts * Fri Oct 01 2021 Steve Grubb 3.0.6-1 - New upstream bugfix release * Tue Sep 14 2021 Steve Grubb 3.0.5-3 - Move BuildRequires around to what actually needs it * Tue Sep 14 2021 Steve Grubb 3.0.5-2 - Drop IPX interpretation support * Wed Aug 11 2021 Steve Grubb 3.0.5-1 - New upstream bugfix release * Sun Aug 08 2021 Steve Grubb 3.0.4-1 - New upstream feature release * Wed Jul 21 2021 Fedora Release Engineering - 3.0.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild * Wed Jul 14 2021 Steve Grubb 3.0.3-1 - New upstream feature release * Thu Jun 24 2021 Sergio Correia - 3.0.2-2 - Do not use custom sbindir and libdir in configure * Thu Jun 10 2021 Steve Grubb 3.0.2-1 - New upstream feature and bugfix release * Fri Jun 04 2021 Python Maint - 3.0.1-3 - Rebuilt for Python 3.10 * Thu Feb 18 2021 Steve Grubb 3.0.1-2 - Add patch fixing segafult in the audisp-statsd plugin * Fri Feb 12 2021 Steve Grubb 3.0.1-1 - New upstream feature and bugfix release - Enable building the audisp-statsd plugin * Tue Jan 26 2021 Fedora Release Engineering - 3.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild * Wed Dec 16 2020 Steve Grubb 3.0-1 - New upstream feature and bugfix release * Mon Jul 27 2020 Fedora Release Engineering - 3.0-0.21.20191104git1c2f876 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Tue May 26 2020 Miro Hrončok - 3.0-0.20.20191104git1c2f876 - Rebuilt for Python 3.9 * Thu Mar 12 2020 Steve Grubb 3.0-0.19.20191104git1c2f876 - Add Obsolete python2-audit (#1783061) * Wed Jan 29 2020 Steve Grubb 3.0-0.18.20191104git1c2f876 - Fix multiple definition of `event_node_list' (#1794446) * Tue Jan 28 2020 Fedora Release Engineering - 3.0-0.17.20191104git1c2f876 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Fri Nov 22 2019 Steve Grubb 3.0-0.16.20191104git1c2f876 - Drop python2 subpackage (#1775076) * Mon Nov 04 2019 Steve Grubb 3.0-0.14.20191104git1c2f876 - New upstream git snapshot prerelease * Thu Oct 03 2019 Miro Hrončok - 3.0-0.14.20190507gitf58ec40 - Rebuilt for Python 3.8.0rc1 (#1748018) * Mon Aug 19 2019 Miro Hrončok - 3.0-0.13.20190507gitf58ec40 - Rebuilt for Python 3.8 * Wed Jul 31 2019 Steve Grubb 3.0-0.12.20190507gitf58ec40 - Fix 1734953 - audit: FTBFS in Fedora rawhide/f31 * Wed Jul 24 2019 Fedora Release Engineering - 3.0-0.11.20190507gitf58ec40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Fri Jul 05 2019 Steve Grubb 3.0-0.10.20190507gitf58ec40 - Add initscripts package to the requires (bz #1727058) * Mon Jun 10 2019 Steve Grubb 3.0-0.9.20190507gitf58ec40 - New upstream git snapshot prerelease which fixes several problems - Fixed 1698130 - removing audit.rpm doesn't stop auditd * Tue Mar 26 2019 Steve Grubb 3.0-0.7.20190326git03e7489 - New upstream git snapshot prerelease which fixes a memory leak * Thu Jan 31 2019 Fedora Release Engineering - 3.0-0.6.20181218gitbdb72c0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Tue Dec 18 2018 Steve Grubb 3.0-0.5.20181218gitbdb72c0 - New upstream git snapshot prerelease - Remove historical ldconfig scriptlet (#1644056) * Fri Aug 31 2018 Steve Grubb 3.0-0.4.20180831git0047a6c - New upstream feature prerelease * Wed Aug 08 2018 Steve Grubb 3.0-0.2.20180808git77fbcf3 - New upstream feature prerelease * Tue Jul 17 2018 Steve Grubb 3.0-0.1.20180717gitacd53d1 - New upstream feature prerelease