From patchwork Mon Aug 3 06:45:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?J=C3=B6rg_Sommer?= X-Patchwork-Id: 94274 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C22D8C55175 for ; Mon, 3 Aug 2026 06:45:17 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.93]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.37646.1785739514315953182 for ; Sun, 02 Aug 2026 23:45:15 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@navimatix.de header.s=selector1 header.b=KPGVUlCq; spf=pass (domain: navimatix.de, ip: 52.101.69.93, mailfrom: joerg.sommer@navimatix.de) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=eRgUOWci6Ss0NR4+w5IU9EoMHO6EzRo3kI2sBdHNTK4AzMAqEBHvOvKNv6ET8XaEPLh4tbGv6ZIyzDQIb3GWGOuKWLvSJWzgwmfXN4IdT1Z0+qydqsXIYpqdS0LhpnH6WSYvyGHwSKHClWbZpPnynMoos+dKjD5dVTWdX/UQoNoyvJ2ZpobPoL4BGtw0+dikHJjO3IaO6jYJljjAxa72j+dEM4AuBrgkYvSdUpXysEAGxWP6fwdnkqgaQj4Yu6roePqrpzCySs5Jl7V5rV+qiAZFx6v0WHl5YMELcnrLIpeC4BWRK60E+aTHFj4ujm1Kuus644y4DDY2FLJwYkRmng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=AAxCqg+GEPEZr8HNngEgTxhyqI4lgpb463QYNuAplfc=; b=d/C/VWjXVZlQwqTwyMVSaNygQacD2frqhk2qdvl2CpGpO6I5iiXPmDuj3TTx4482le5kQ7n+35nyxvYgz9qVGHet5DecuUsbKfn0Mfm+n6sIvCyIvjSw0n7M3AoQRUg4q6Uux0q57ihJQFQp0/CBNKIwUeZ+v/don/4YRaURXRW/YWjeNy5y84uA9iCrHBaCVJIV+IbM1XhO9OWoWHsjvjqkVtGq40xSdTnsTaIHqvFwD1AznLDdTN3GBm33qxQ8g+nvXVWJ4Zrf93SX7vyN6aiw2ZjWq8J/zM+O8fIjsbaMppFcNQRl23u5e7AS7MurmJ9PKaPCKt5/IA6s4TJrXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=navimatix.de; dmarc=pass action=none header.from=navimatix.de; dkim=pass header.d=navimatix.de; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=navimatix.de; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AAxCqg+GEPEZr8HNngEgTxhyqI4lgpb463QYNuAplfc=; b=KPGVUlCqA++nx6bttOrlz/kLp3Zd8GJpt7RAqKZ4HomHOPUq3yoxVatxR8l6fvDU3b9DAsf51L6JUcppMegSV0rPasp6MoyyyQXbRF0AOdntZUpHU+pi2W3T/E4W+7/aPg+m7zla+xonvnAEu1C/9V3jaPoAsNQUsAKebYoSZE8= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=navimatix.de; Received: from GV2PR01MB11835.eurprd01.prod.exchangelabs.com (2603:10a6:150:2cb::8) by PA4PR01MB10402.eurprd01.prod.exchangelabs.com (2603:10a6:102:26b::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.17; Mon, 3 Aug 2026 06:45:08 +0000 Received: from GV2PR01MB11835.eurprd01.prod.exchangelabs.com ([fe80::d5c3:2dea:3d98:25fd]) by GV2PR01MB11835.eurprd01.prod.exchangelabs.com ([fe80::d5c3:2dea:3d98:25fd%3]) with mapi id 15.21.0270.015; Mon, 3 Aug 2026 06:45:07 +0000 Date: Mon, 3 Aug 2026 08:45:06 +0200 From: =?utf-8?b?SsO2cmc=?= Sommer To: openembedded-core@lists.openembedded.org, antonin.godard@bootlin.com, joerg.sommer@navimatix.de CC: Antonin Godard , =?utf-8?b?SsO2cmc=?= Sommer Subject: [PATCH] audit: Move 4.1.4 from meta-openembedded Message-ID: X-Mailer: git-send-email 2.53.0 Content-Disposition: inline X-ClientProxiedBy: BE1P281CA0476.DEUP281.PROD.OUTLOOK.COM (2603:10a6:b10:7e::18) To GV2PR01MB11835.eurprd01.prod.exchangelabs.com (2603:10a6:150:2cb::8) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV2PR01MB11835:EE_|PA4PR01MB10402:EE_ X-MS-Office365-Filtering-Correlation-Id: d3d8532e-6f61-4452-71a8-08def12ac1d1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|13003099007|6133799003|5023799004|56012099006|10067099003|3023799007|18002099003; X-Microsoft-Antispam-Message-Info: aGZD/APhehxqWMuJdLh1iivG1VLby2hObS18tPzf5Ue6LHHMuPSgRGZhZKa/3KN59aw8EGJc+TCe3TBf4unECnQOYoNpxarK9oNxQ9fhNVHW2VStkN0eSWApld1AZFriEKO4xlYfPfjVW4jmFo3st6F+COyCpOqI4yAc6ykvwVQkw6qhiDwFdz0EdXZLRgZ6NePK47GR+9RHspRIfcnKSHVwEKfcllUhidDyye0PwGWklBGw8Q5wEZ7Iuo5sK1Tj4RwmiukXbkIoIY0bEEpAXemBf0Qs9/bXpGi0Yiyu0KnHfmdw4/8igM3IQZRr489op/knmthUgagrxt5xpvG3syhok1h8lf4SeGIzewAA0Kp9yFTPGy+kJufSlPJknYHy3KN6wl+Rp6wBion6yNJsjVmSRP1zn6wxENUb4WtXpfCQzrPqW+vHxRjMxcBCVTD5a2Rh2kNTLlx6v/nadQqjwHHdTNFm2Zi9mOb12qlPLFL8Wsql9HAb7pvy9OsXCeEXJaKOkwM83pHWecXQLMXcseOdKLPsCeFOUc/PyycENpPbvoodGyPWRg0p3SYk7J0AKp+jWOBp7A09zNxiarBuEvOK0aSQntfPyIsj5dOJ41u6FVQABxDyPGQinrDvhasEbOlNWfgjsIMFMLszPHqehvoy1uCjZTs2ptPXbgtuXoA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR01MB11835.eurprd01.prod.exchangelabs.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(13003099007)(6133799003)(5023799004)(56012099006)(10067099003)(3023799007)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: eShuzA12G5T+xYzV8lDOUoLeC3RSdSgFopHG4l3ecyF1RB3rJ6w/6Ow0iY2ktNV/ElLWyeQGVCiLquzIQ5FxFcKVwFq36IX+CStF0duvRUzzPYgwORAGmWL+1WpJ/+7rc/jOzq+m48XAUiguKCt3dnV4pgf+rcrUcPxkRT4+7Hw1XxlCf9RTe73U5+KhiEQvNcEWLGuHRcDTbjXINSKziieu2D2hPAvDKCBd9rpWh4wTRFRCQ54VjJZ4wlFPzImqMYnhcUD6uR4bB50FrhFLup0dZE+8dGP4Phd6DDrPos5oeatwq59ibz0w4UaODEKFoxfhnXR8pwCAD0m800tTeKubF6KxclRmexn2p19XRrxwUv+3KuWqEebjZf3doccxiKdi6WTVIkcC+qaD3n6PR4/CXQmTJkP+n6dVBh+rbHrfZY85oMba+Pi5UoRDD5dGfhJ93tWYfzujKB1sPp0P70gdSLCzL39/5Ub771spmxcpV+N6lXmXrtiQodk5mctJ6WanK43ONFmVrb4Sk8JO7ncraAqsbQBWXiNruFb5PfggPIkw8t0Ap1pePBPLyctKhz4HSBjKPyFU0hjm0ijJbqIZQDvmjHbEAl75Gc8gIrmgj0ri5o/vu/S2mvRKgA+azdnMWeMDLPmJubss/aLXcg/KRibJbNiJjEM8Ra9FfpxBFOXT/i/0heF+l80/5ybv48DxXOGG2FmXBT+BvmTWYYCvdBslOGzN7XNyjyS4kbU2GqzC003cPx7k/H5JCuaXapE7DLXtv4WZexUrnqBUlgXa04pcCpBsdcVj1uMjP7XrqW2h8HFvbfIMOgwNeFfZYqLJ0U9vX9Mb5H8bl4yrwhalESz1mHx7g4kzaB2IT+pLUhHY8TdrDR/34G+oUY/tHxDhVn5DSWy42pTp86gpjHwMplA86phZDY6NZYuT9l4OjKijTXCIy6cxKTzDAxIss/8Eh3pknnrf5IC1AmxCQ2HypSbRjQA1IVCDnAiRvDqGcB4FaegWD6W2Bn7SOg/bn+aHIoga6lhbfqpKAHn3PY7LtqwMen9EPEa5PmneelTMc0sD+xhxXVK3xcWgcwtN9yXOzE57fOwhZfS4aKqn6qg4z7/zde8Awst7823e6q54IaGp+o2QMyO7MzXUt9cZM95Rtod0yrovUod/64q2DyIjjsAfnKaaeydSG3uzd5d9JCNyF2tmo0PbckzqJII247gsLZM+FKt9T2lfH12Yle8xI17HUB9OLEK8rwIf5JrRvgdumWDm8gJ26z4KLmNzk9XHqXwqARsqcAUEmNhuV35PBCUOuDXL+cV/kSQty8zvhbDvWYu1rd9fHmcPh7L+lTCwsWoMbTkmA4h7R6eE5Vga8UL+mD0g8XcAn6qprnDQBxyvOac89QBTTyL/GD2Mh+pyV7HcVh8wHCbXBWjcLgdgGp/fbazZ/V6WyzB67cPiZmPsChAITcBpyx7lyfzjAEicMKjMc02erbIedcApoL/GllbS2x5eQ0oOU7RY5X9Ra293+7Gs5O3mk0g3Qe3oYodafr5BWkgtUtdAZoUFwatlpWYL+5amYcJ7UgP85UNfKTX/gJL4W5H2sy4+UrsuQbJNPXL67ea8DMAXVpXpiz2x/WgHOmiw3NOdsScQ8NCNYGCtZzHiJVvRT4IereKDK/WUCvgwRT3BUlqktakSBC7aY0RvcnTaduMWq4d0+iEuB9AAVhyxFPk1Up97M+K+kwzgLsnrcUBS4qXQwjv9qx9QnVwCZuPb2TeYjayn0ro= X-OriginatorOrg: navimatix.de X-MS-Exchange-CrossTenant-Network-Message-Id: d3d8532e-6f61-4452-71a8-08def12ac1d1 X-MS-Exchange-CrossTenant-AuthSource: GV2PR01MB11835.eurprd01.prod.exchangelabs.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 06:45:07.8560 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: c87b4f54-b992-4813-8f3f-4a876324197f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: aLcZMKZgd/fKoKOcN8zmv/ovXv6ySNoFAOEZyzB/HsVMSGRAdzJumDJo75myP9taqW3e+0bR7EbT8l4we/Gq3hFoiXP1W4GoJ6TO/xrmVrk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR01MB10402 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 06:45:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242609 From: Jörg Sommer With the new established distro feature *audit* in oe-core the tools for this should be available too. Therefore, include the recipe from 8f3df8b447aa8a27ce15ccdcfa9d3eb253c08dc2 in meta-openembedded. Signed-off-by: Jörg Sommer --- ...-Fixed-swig-host-contamination-issue.patch | 54 +++++ ...te-ax_prog_cc_for_build.m4-to-latest.patch | 196 ++++++++++++++++++ meta/recipes-security/audit/audit/auditd | 153 ++++++++++++++ meta/recipes-security/audit/audit_4.1.4.bb | 107 ++++++++++ 4 files changed, 510 insertions(+) create mode 100644 meta/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch create mode 100644 meta/recipes-security/audit/audit/0001-m4-update-ax_prog_cc_for_build.m4-to-latest.patch create mode 100644 meta/recipes-security/audit/audit/auditd create mode 100644 meta/recipes-security/audit/audit_4.1.4.bb diff --git a/meta/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch b/meta/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch new file mode 100644 index 0000000000..087b31cc21 --- /dev/null +++ b/meta/recipes-security/audit/audit/0001-Fixed-swig-host-contamination-issue.patch @@ -0,0 +1,54 @@ +From 14e49fe508a150d99ac18e35887b7d75e84c47d8 Mon Sep 17 00:00:00 2001 +From: Li xin +Date: Sun, 19 Jul 2015 02:42:58 +0900 +Subject: [PATCH] Fixed swig host contamination issue + +The audit build uses swig to generate a python wrapper. +Unfortunately, the swig info file references host include +directories. Some of these were previously noticed and +eliminated, but the one fixed here was not. + +Upstream-Status: Inappropriate [embedded specific] + +Signed-off-by: Anders Hedlund +Signed-off-by: Joe Slater +Signed-off-by: Yi Zhao +--- + bindings/swig/python3/Makefile.am | 3 ++- + bindings/swig/src/auditswig.i | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/bindings/swig/python3/Makefile.am b/bindings/swig/python3/Makefile.am +index f8f6db18..171e96a6 100644 +--- a/bindings/swig/python3/Makefile.am ++++ b/bindings/swig/python3/Makefile.am +@@ -23,6 +23,7 @@ + CONFIG_CLEAN_FILES = *.loT *.rej *.orig + AM_CFLAGS = -fPIC -DPIC -fno-strict-aliasing $(PYTHON3_CFLAGS) + AM_CPPFLAGS = -I. -I$(top_builddir) -I${top_srcdir}/lib $(PYTHON3_INCLUDES) ++STDINC ?= /usr/include + LIBS = $(top_builddir)/lib/libaudit.la + SWIG_FLAGS = -python + SWIG_INCLUDES = -I. -I$(top_builddir) -I${top_srcdir}/lib $(PYTHON3_INCLUDES) +@@ -34,7 +35,7 @@ _audit_la_DEPENDENCIES =${top_srcdir}/lib/audit_logging.h ${top_builddir}/lib/li + _audit_la_LIBADD = ${top_builddir}/lib/libaudit.la $(PYTHON3_LIBS) + nodist__audit_la_SOURCES = audit_wrap.c + audit.py audit_wrap.c: ${srcdir}/../src/auditswig.i +- swig -o audit_wrap.c ${SWIG_FLAGS} ${SWIG_INCLUDES} ${srcdir}/../src/auditswig.i ++ swig -o audit_wrap.c ${SWIG_FLAGS} ${SWIG_INCLUDES} -I$(STDINC) ${srcdir}/../src/auditswig.i + + CLEANFILES = audit.py* audit_wrap.c *~ + +diff --git a/bindings/swig/src/auditswig.i b/bindings/swig/src/auditswig.i +index 2760e516..5d0ea8b6 100644 +--- a/bindings/swig/src/auditswig.i ++++ b/bindings/swig/src/auditswig.i +@@ -52,7 +52,7 @@ typedef unsigned uid_t; + */ + %ignore audit_rule_data::buf; + +-%include "/usr/include/linux/audit.h" ++%include "../lib/audit.h" + #define __extension__ /*nothing*/ + %include + %include "../lib/audit-records.h" diff --git a/meta/recipes-security/audit/audit/0001-m4-update-ax_prog_cc_for_build.m4-to-latest.patch b/meta/recipes-security/audit/audit/0001-m4-update-ax_prog_cc_for_build.m4-to-latest.patch new file mode 100644 index 0000000000..cf322b8e1a --- /dev/null +++ b/meta/recipes-security/audit/audit/0001-m4-update-ax_prog_cc_for_build.m4-to-latest.patch @@ -0,0 +1,196 @@ +From 3da79b330527b5f9d6e6243c8ba12968810965a3 Mon Sep 17 00:00:00 2001 +From: Martin Jansa +Date: Fri, 10 Apr 2026 14:53:41 +0200 +Subject: [PATCH] m4: update ax_prog_cc_for_build.m4 to latest +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +After the autoconf update to 2.73 this was using -std=gnu23 +even on hosts with gcc-13 which doesn't support it: + +ac_cv_prog_ac_ct_CC_FOR_BUILD='gcc ' +ac_cv_prog_cc_c23=-std=gnu23 +ac_cv_prog_cc_g=yes +ac_cv_prog_cc_stdc=-std=gnu23 + +Leading to: +gcc -std=gnu23 -DHAVE_CONFIG_H -I. -I../../sources/audit-4.1.4/lib -I.. -I. -I../../sources/audit-4.1.4 -I../../sources/audit-4.1.4/auparse -I../../sources/audit-4.1.4/common -isystem/audit/4.1.4/recipe-sysroot-native/usr/include '-DTABLE_H="fieldtab.h"' -isystem/audit/4.1.4/recipe-sysroot-native/usr/include -O2 -pipe -c -o gen_fieldtabs_h-gen_tables.o `test -f 'gen_tables.c' || echo '../../sources/audit-4.1.4/lib/'`gen_tables.c +gcc: error: unrecognized command-line option â?~-std=gnu23â?T; did you mean â?~-std=gnu2xâ?T? + +Needs the updated ac_cv_prog_cc_c23 from: +https://github.com/autoconf-archive/autoconf-archive/commit/8a970ce96721f516fef4226e5eca8da341159765 + +Upstream-Status: Submitted [https://github.com/linux-audit/audit-userspace/pull/524] +Signed-off-by: Martin Jansa +--- + m4/ax_prog_cc_for_build.m4 | 100 +++++++++++++++++++++++++++---------- + 1 file changed, 75 insertions(+), 25 deletions(-) + +diff --git a/m4/ax_prog_cc_for_build.m4 b/m4/ax_prog_cc_for_build.m4 +index 77fd346a..4d1de993 100644 +--- a/m4/ax_prog_cc_for_build.m4 ++++ b/m4/ax_prog_cc_for_build.m4 +@@ -1,5 +1,5 @@ + # =========================================================================== +-# http://www.gnu.org/software/autoconf-archive/ax_prog_cc_for_build.html ++# https://www.gnu.org/software/autoconf-archive/ax_prog_cc_for_build.html + # =========================================================================== + # + # SYNOPSIS +@@ -32,28 +32,32 @@ + # and this notice are preserved. This file is offered as-is, without any + # warranty. + +-#serial 8 ++#serial 26 + + AU_ALIAS([AC_PROG_CC_FOR_BUILD], [AX_PROG_CC_FOR_BUILD]) + AC_DEFUN([AX_PROG_CC_FOR_BUILD], [dnl + AC_REQUIRE([AC_PROG_CC])dnl + AC_REQUIRE([AC_PROG_CPP])dnl +-AC_REQUIRE([AC_EXEEXT])dnl +-AC_REQUIRE([AC_CANONICAL_HOST])dnl ++AC_REQUIRE([AC_CANONICAL_BUILD])dnl + + dnl Use the standard macros, but make them use other variable names + dnl + pushdef([ac_cv_prog_CPP], ac_cv_build_prog_CPP)dnl + pushdef([ac_cv_prog_gcc], ac_cv_build_prog_gcc)dnl ++pushdef([ac_cv_prog_cc_c89], ac_cv_build_prog_cc_c89)dnl ++pushdef([ac_cv_prog_cc_c99], ac_cv_build_prog_cc_c99)dnl ++pushdef([ac_cv_prog_cc_c11], ac_cv_build_prog_cc_c11)dnl ++pushdef([ac_cv_prog_cc_c23], ac_cv_build_prog_cc_c23)dnl ++pushdef([ac_cv_prog_cc_stdc], ac_cv_build_prog_cc_stdc)dnl + pushdef([ac_cv_prog_cc_works], ac_cv_build_prog_cc_works)dnl + pushdef([ac_cv_prog_cc_cross], ac_cv_build_prog_cc_cross)dnl + pushdef([ac_cv_prog_cc_g], ac_cv_build_prog_cc_g)dnl +-pushdef([ac_cv_exeext], ac_cv_build_exeext)dnl +-pushdef([ac_cv_objext], ac_cv_build_objext)dnl ++pushdef([ac_prog_cc_stdc], ac_build_prog_cc_stdc)dnl + pushdef([ac_exeext], ac_build_exeext)dnl + pushdef([ac_objext], ac_build_objext)dnl + pushdef([CC], CC_FOR_BUILD)dnl + pushdef([CPP], CPP_FOR_BUILD)dnl ++pushdef([GCC], GCC_FOR_BUILD)dnl + pushdef([CFLAGS], CFLAGS_FOR_BUILD)dnl + pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl + pushdef([LDFLAGS], LDFLAGS_FOR_BUILD)dnl +@@ -67,27 +71,58 @@ pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl + pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl + pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl + pushdef([ac_cv_host_os], ac_cv_build_os)dnl +-pushdef([ac_cpp], ac_build_cpp)dnl +-pushdef([ac_compile], ac_build_compile)dnl +-pushdef([ac_link], ac_build_link)dnl ++pushdef([ac_tool_prefix], ac_build_tool_prefix)dnl ++pushdef([am_cv_CC_dependencies_compiler_type], am_cv_build_CC_dependencies_compiler_type)dnl ++pushdef([am_cv_prog_cc_c_o], am_cv_build_prog_cc_c_o)dnl ++pushdef([cross_compiling], cross_compiling_build)dnl ++dnl ++dnl These variables are problematic to rename by M4 macros, so we save ++dnl their values in alternative names, and restore the values later. ++dnl ++dnl _AC_COMPILER_EXEEXT and _AC_COMPILER_OBJEXT internally call ++dnl AC_SUBST which prevents the renaming of EXEEXT and OBJEXT ++dnl variables. It's not a good idea to rename ac_cv_exeext and ++dnl ac_cv_objext either as they're related. ++dnl Renaming ac_exeext and ac_objext is safe though. ++dnl ++ac_cv_host_exeext=$ac_cv_exeext ++AS_VAR_SET_IF([ac_cv_build_exeext], ++ [ac_cv_exeext=$ac_cv_build_exeext], ++ [AS_UNSET([ac_cv_exeext])]) ++ac_cv_host_objext=$ac_cv_objext ++AS_VAR_SET_IF([ac_cv_build_objext], ++ [ac_cv_objext=$ac_cv_build_objext], ++ [AS_UNSET([ac_cv_objext])]) ++dnl ++dnl ac_cv_c_compiler_gnu is used in _AC_LANG_COMPILER_GNU (called by ++dnl AC_PROG_CC) indirectly. ++dnl ++ac_cv_host_c_compiler_gnu=$ac_cv_c_compiler_gnu ++AS_VAR_SET_IF([ac_cv_build_c_compiler_gnu], ++ [ac_cv_c_compiler_gnu=$ac_cv_build_c_compiler_gnu], ++ [AS_UNSET([ac_cv_c_compiler_gnu])]) ++ ++cross_compiling_build=no + +-save_cross_compiling=$cross_compiling +-save_ac_tool_prefix=$ac_tool_prefix +-cross_compiling=no +-ac_tool_prefix= ++ac_build_tool_prefix= ++AS_IF([test -n "$build"], [ac_build_tool_prefix="$build-"], ++ [test -n "$build_alias"],[ac_build_tool_prefix="$build_alias-"]) + ++AC_LANG_PUSH([C]) + AC_PROG_CC ++_AC_COMPILER_EXEEXT ++_AC_COMPILER_OBJEXT + AC_PROG_CPP +-AC_EXEEXT + +-ac_tool_prefix=$save_ac_tool_prefix +-cross_compiling=$save_cross_compiling ++BUILD_EXEEXT=$ac_cv_exeext ++BUILD_OBJEXT=$ac_cv_objext + + dnl Restore the old definitions + dnl +-popdef([ac_link])dnl +-popdef([ac_compile])dnl +-popdef([ac_cpp])dnl ++popdef([cross_compiling])dnl ++popdef([am_cv_prog_cc_c_o])dnl ++popdef([am_cv_CC_dependencies_compiler_type])dnl ++popdef([ac_tool_prefix])dnl + popdef([ac_cv_host_os])dnl + popdef([ac_cv_host_vendor])dnl + popdef([ac_cv_host_cpu])dnl +@@ -101,24 +136,39 @@ popdef([host])dnl + popdef([LDFLAGS])dnl + popdef([CPPFLAGS])dnl + popdef([CFLAGS])dnl ++popdef([GCC])dnl + popdef([CPP])dnl + popdef([CC])dnl + popdef([ac_objext])dnl + popdef([ac_exeext])dnl +-popdef([ac_cv_objext])dnl +-popdef([ac_cv_exeext])dnl ++popdef([ac_prog_cc_stdc])dnl + popdef([ac_cv_prog_cc_g])dnl + popdef([ac_cv_prog_cc_cross])dnl + popdef([ac_cv_prog_cc_works])dnl ++popdef([ac_cv_prog_cc_stdc])dnl ++popdef([ac_cv_prog_cc_c23])dnl ++popdef([ac_cv_prog_cc_c11])dnl ++popdef([ac_cv_prog_cc_c99])dnl ++popdef([ac_cv_prog_cc_c89])dnl + popdef([ac_cv_prog_gcc])dnl + popdef([ac_cv_prog_CPP])dnl ++dnl ++ac_cv_exeext=$ac_cv_host_exeext ++EXEEXT=$ac_cv_host_exeext ++ac_cv_objext=$ac_cv_host_objext ++OBJEXT=$ac_cv_host_objext ++ac_cv_c_compiler_gnu=$ac_cv_host_c_compiler_gnu ++ac_compiler_gnu=$ac_cv_host_c_compiler_gnu ++ ++dnl restore global variables ac_ext, ac_cpp, ac_compile, ++dnl ac_link, ac_compiler_gnu (dependent on the current ++dnl language after popping): ++AC_LANG_POP([C]) + + dnl Finally, set Makefile variables + dnl +-BUILD_EXEEXT=$ac_build_exeext +-BUILD_OBJEXT=$ac_build_objext +-AC_SUBST(BUILD_EXEEXT)dnl +-AC_SUBST(BUILD_OBJEXT)dnl ++AC_SUBST([BUILD_EXEEXT])dnl ++AC_SUBST([BUILD_OBJEXT])dnl + AC_SUBST([CFLAGS_FOR_BUILD])dnl + AC_SUBST([CPPFLAGS_FOR_BUILD])dnl + AC_SUBST([LDFLAGS_FOR_BUILD])dnl diff --git a/meta/recipes-security/audit/audit/auditd b/meta/recipes-security/audit/audit/auditd new file mode 100644 index 0000000000..6aa7f94751 --- /dev/null +++ b/meta/recipes-security/audit/audit/auditd @@ -0,0 +1,153 @@ +#! /bin/sh +### BEGIN INIT INFO +# Provides: auditd +# Required-Start: $local_fs +# Required-Stop: $local_fs +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: Audit Daemon +# Description: Collects audit information from Linux 2.6 Kernels. +### END INIT INFO + +# Author: Philipp Matthias Hahn +# Based on Debians /etc/init.d/skeleton and Auditds init.d/auditd.init + +# June, 2012: Adopted for yocto + +# PATH should only include /usr/* if it runs after the mountnfs.sh script +PATH=/sbin:/bin:/usr/sbin:/usr/bin +DESC="audit daemon" +NAME=auditd +DAEMON=/sbin/auditd +PIDFILE=/var/run/"$NAME".pid +SCRIPTNAME=/etc/init.d/"$NAME" + +# Exit if the package is not installed +[ -x "$DAEMON" ] || exit 0 + +# Read configuration variable file if it is present +[ -r /etc/default/"$NAME" ] && . /etc/default/"$NAME" + +. /etc/default/rcS + +. /etc/init.d/functions + +# +# Function that starts the daemon/service +# +do_start() +{ + # Return + # 0 if daemon has been started + # 1 if daemon was already running + # 2 if daemon could not be started + start-stop-daemon -S --quiet --pidfile "$PIDFILE" --exec "$DAEMON" --test > /dev/null \ + || return 1 + start-stop-daemon -S --quiet --pidfile "$PIDFILE" --exec "$DAEMON" -- \ + $EXTRAOPTIONS \ + || return 2 + if [ -f /etc/audit/audit.rules ] + then + /sbin/auditctl -R /etc/audit/audit.rules >/dev/null + fi +} + +# +# Function that stops the daemon/service +# +do_stop() +{ + # Return + # 0 if daemon has been stopped + # 1 if daemon was already stopped + # 2 if daemon could not be stopped + # other if a failure occurred + start-stop-daemon -K --quiet --pidfile "$PIDFILE" --name "$NAME" + RETVAL="$?" + [ "$RETVAL" = 2 ] && return 2 + # Many daemons don't delete their pidfiles when they exit. + rm -f "$PIDFILE" + rm -f /var/run/audit_events + # Remove watches so shutdown works cleanly + case "$AUDITD_CLEAN_STOP" in + no|NO) ;; + *) /sbin/auditctl -D >/dev/null ;; + esac + return "$RETVAL" +} + +# +# Function that sends a SIGHUP to the daemon/service +# +do_reload() { + start-stop-daemon -K --signal HUP --quiet --pidfile $PIDFILE --name $NAME + return 0 +} + +if [ ! -e /var/log/audit ]; then + mkdir -p /var/log/audit + [ -x /sbin/restorecon ] && /sbin/restorecon -F $(readlink -f /var/log/audit) +fi + +case "$1" in + start) + [ "$VERBOSE" != no ] && echo "Starting $DESC" "$NAME" + do_start + case "$?" in + 0|1) [ "$VERBOSE" != no ] && echo 0 ;; + 2) [ "$VERBOSE" != no ] && echo 1 ;; + esac + ;; + stop) + [ "$VERBOSE" != no ] && echo "Stopping $DESC" "$NAME" + do_stop + case "$?" in + 0|1) [ "$VERBOSE" != no ] && echo 0 ;; + 2) [ "$VERBOSE" != no ] && echo 1 ;; + esac + ;; + reload|force-reload) + echo "Reloading $DESC" "$NAME" + do_reload + echo $? + ;; + restart) + echo "Restarting $DESC" "$NAME" + do_stop + case "$?" in + 0|1) + do_start + case "$?" in + 0) echo 0 ;; + 1) echo 1 ;; # Old process is still running + *) echo 1 ;; # Failed to start + esac + ;; + *) + # Failed to stop + echo 1 + ;; + esac + ;; + rotate) + echo "Rotating $DESC logs" "$NAME" + start-stop-daemon -K --signal USR1 --quiet --pidfile "$PIDFILE" --name "$NAME" + echo $? + ;; + status) + pidofproc "$DAEMON" >/dev/null + status=$? + if [ $status -eq 0 ]; then + echo "$NAME is running." + else + echo "$NAME is not running." + fi + exit $status + ;; + *) + echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload|rotate|status}" >&2 + exit 3 + ;; +esac + +: diff --git a/meta/recipes-security/audit/audit_4.1.4.bb b/meta/recipes-security/audit/audit_4.1.4.bb new file mode 100644 index 0000000000..363746ccf0 --- /dev/null +++ b/meta/recipes-security/audit/audit_4.1.4.bb @@ -0,0 +1,107 @@ +SUMMARY = "User space tools for kernel auditing" +DESCRIPTION = "The audit package contains the user space utilities for \ +storing and searching the audit records generated by the audit subsystem \ +in the Linux kernel." +HOMEPAGE = "http://people.redhat.com/sgrubb/audit/" +SECTION = "base" +LICENSE = "GPL-2.0-or-later AND LGPL-2.0-or-later" +LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f" + +SRC_URI = "git://github.com/linux-audit/${BPN}-userspace.git;branch=master;protocol=https;tag=v${PV} \ + file://0001-Fixed-swig-host-contamination-issue.patch \ + file://0001-m4-update-ax_prog_cc_for_build.m4-to-latest.patch \ + file://auditd \ + " + +SRCREV = "07eea50408d28c953d4048dfef3da6556ce4b569" + +inherit autotools python3targetconfig update-rc.d systemd + +UPDATERCPN = "auditd" +INITSCRIPT_NAME = "auditd" +INITSCRIPT_PARAMS = "defaults" + +SYSTEMD_PACKAGES = "auditd" +SYSTEMD_SERVICE:auditd = "auditd.service audit-rules.service" + +DEPENDS = "python3 libcap-ng linux-libc-headers swig-native python3-setuptools-native coreutils-native" + +EXTRA_OECONF = " \ + --with-libcap-ng \ + --with-python3 \ + --with-arm \ + --with-aarch64 \ + --with-riscv \ + --without-golang \ + --disable-gssapi-krb5 \ + --disable-zos-remote \ + --sbindir=${base_sbindir} \ + --runstatedir=/run \ + " + +EXTRA_OEMAKE = " \ + PYTHON=python3 \ + pythondir=${PYTHON_SITEPACKAGES_DIR} \ + pyexecdir=${PYTHON_SITEPACKAGES_DIR} \ + STDINC='${STAGING_INCDIR}' \ + " + +SUMMARY:audispd-plugins = "Plugins for the audit event dispatcher" +DESCRIPTION:audispd-plugins = "The audispd-plugins package provides plugins for the real-time \ +interface to the audit system, audispd. These plugins can do things \ +like relay events to remote machines or analyze events for suspicious \ +behavior." + +PACKAGES =+ "audispd-plugins" +PACKAGES += "auditd ${PN}-python" + +FILES:${PN} = "${sysconfdir}/libaudit.conf ${libdir}/libau*.so.*" +FILES:auditd = "${bindir}/* ${base_sbindir}/* ${sysconfdir}/* \ + ${datadir}/audit-rules/* ${libexecdir}/* \ + ${nonarch_libdir}/tmpfiles.d/*.conf" +FILES:audispd-plugins = "${sysconfdir}/audit/audisp-remote.conf \ + ${sysconfdir}/audit/plugins.d/au-remote.conf \ + ${sysconfdir}/audit/plugins.d/syslog.conf \ + ${base_sbindir}/audisp-remote \ + ${base_sbindir}/audisp-syslog \ + ${localstatedir}/spool/audit \ + " +FILES:${PN}-dbg += "${libdir}/python${PYTHON_BASEVERSION}/*/.debug" +FILES:${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}" + +CONFFILES:auditd = "${sysconfdir}/audit/audit.rules" + +do_configure:prepend() { + sed -e 's|buf\[];|buf[0];|g' ${STAGING_INCDIR}/linux/audit.h > ${S}/lib/audit.h + sed -i -e 's|#include |#include "audit.h"|g' ${S}/lib/libaudit.h +} + +do_install:append() { + sed -i -e 's|#include "audit.h"|#include |g' ${D}${includedir}/libaudit.h + + # Install default rules + install -d -m 750 ${D}/etc/audit + install -d -m 750 ${D}/etc/audit/rules.d + + install -m 0640 ${S}/rules/10-base-config.rules ${D}/etc/audit/rules.d/audit.rules + + # Based on the audit.spec "Copy default rules into place on new installation" + install -m 0640 ${D}/etc/audit/rules.d/audit.rules ${D}/etc/audit/audit.rules + + if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then + install -D -m 0755 ${UNPACKDIR}/auditd ${D}/etc/init.d/auditd + fi + + if ! ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + rm -rf ${D}${nonarch_libdir}/systemd + rm -rf ${D}${nonarch_libdir}/tmpfiles.d + + # Remove empty directory when enable multilib + rmdir --ignore-fail-on-non-empty ${D}${nonarch_libdir} + fi + + # Create /var/spool/audit directory for audisp-remote + install -d -m 0700 ${D}${localstatedir}/spool/audit +} + +CVE_PRODUCT = "linux:audit"