diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index d17d7e0..cef7fab 100644 --- a/.gitignore +++ b/.gitignore @@ -73,3 +73,33 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2001.0.tar.gz /rsyslog-8.2002.0.tar.gz /rsyslog-doc-8.2002.0.tar.gz +/rsyslog-8.2008.0.tar.gz +/rsyslog-doc-8.2008.0.tar.gz +/rsyslog-8.2010.0.tar.gz +/rsyslog-doc-8.2010.0.tar.gz +/qpid-proton-0.31.0.tar.gz +/rsyslog-8.2102.0.tar.gz +/rsyslog-doc-8.2102.0.tar.gz +/qpid-proton-0.34.0.tar.gz +/rsyslog-8.2204.0.tar.gz +/rsyslog-doc-8.2204.0.tar.gz +/rsyslog-8.2210.0.tar.gz +/rsyslog-doc-8.2210.0.tar.gz +/rsyslog-8.2306.0.tar.gz +/rsyslog-doc-8.2306.0.tar.gz +/rsyslog-8.2308.0.tar.gz +/rsyslog-doc-8.2308.0.tar.gz +/qpid-proton-0.39.0.tar.gz +/rsyslog-8.2310.0.tar.gz +/rsyslog-doc-8.2310.0.tar.gz +/rsyslog-8.2312.0.tar.gz +/rsyslog-doc-8.2312.0.tar.gz +/rsyslog-8.2408.0.tar.gz +/rsyslog-doc-8.2408.0.tar.gz +/rsyslog-8.2412.0.tar.gz +/rsyslog-doc-8.2412.0.tar.gz +/rsyslog-8.2506.0.tar.gz +/rsyslog-doc-8.2506.0.tar.gz +/rsyslog-8.2508.0.tar.gz +/qpid-proton-0.40.0.tar.gz +/rsyslog-8.2510.0.tar.gz diff --git a/imjournal-rewrite.patch b/imjournal-rewrite.patch deleted file mode 100644 index d8124ee..0000000 --- a/imjournal-rewrite.patch +++ /dev/null @@ -1,752 +0,0 @@ -From 78976a9bc0592317be2e41b7f3703803f7971e1e Mon Sep 17 00:00:00 2001 -From: Jiri Vymazal -Date: Wed, 25 Sep 2019 15:18:57 +0200 -Subject: [PATCH] plugin code restructuring, added remote option - -Decomposed ReadJournal() a bit, also now coupling journald -variables in one struct, added few warning messages and debug -prints to help with bug hunts in future, also got rid of two -needless journald calls. WorkAroundJournalBug now deprecated. -Added option to pull journald records from outside local machine. ---- - plugins/imjournal/imjournal.c | 368 ++++++++++++++++++++-------------- - 1 file changed, 214 insertions(+), 154 deletions(-) - -diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c -index 2e27922b51..8008f159c4 100644 ---- a/plugins/imjournal/imjournal.c -+++ b/plugins/imjournal/imjournal.c -@@ -81,8 +81,9 @@ static struct configSettings_s { - int iDfltFacility; - int bUseJnlPID; - char *usePid; -- int bWorkAroundJournalBug; -+ int bWorkAroundJournalBug; /* deprecated, left for backwards compatibility only */ - int bFsync; -+ int bRemote; - } cs; - - static rsRetVal facilityHdlr(uchar **pp, void *pVal); -@@ -100,7 +101,8 @@ static struct cnfparamdescr modpdescr[] = { - { "usepidfromsystem", eCmdHdlrBinary, 0 }, - { "usepid", eCmdHdlrString, 0 }, - { "workaroundjournalbug", eCmdHdlrBinary, 0 }, -- { "fsync", eCmdHdlrBinary, 0 } -+ { "fsync", eCmdHdlrBinary, 0 }, -+ { "remote", eCmdHdlrBinary, 0 } - }; - static struct cnfparamblk modpblk = - { CNFPARAMBLK_VERSION, -@@ -120,8 +122,6 @@ static prop_t *pLocalHostIP = NULL; /* a pseudo-constant propterty for 127.0.0.1 - static const char *pidFieldName; /* read-only after startup */ - static int bPidFallBack; - static ratelimit_t *ratelimiter = NULL; --static sd_journal *j; --static sbool reloaded = 0; - static struct { - statsobj_t *stats; - STATSCOUNTER_DEF(ctrSubmitted, mutCtrSubmitted) -@@ -134,34 +134,58 @@ static struct { - uint64 ratelimitDiscardedInInterval; - uint64 diskUsageBytes; - } statsCounter; --static char *last_cursor = NULL; -+struct journalContext_s { /* structure encapsulating all the journald_API-related stuff */ -+ sd_journal *j; /* main object encapsulating journal for us, has to be used in every sd_journal*() call */ -+ sbool reloaded; /* we have reloaded journal after detecting rotation */ -+ sbool atHead; /* true if we are at start of journal (no seek was done) */ -+ char *cursor; /* should point to last valid journald entry we processed */ -+}; -+static struct journalContext_s journalContext = {NULL, 0, 1, NULL}; - - #define J_PROCESS_PERIOD 1024 /* Call sd_journal_process() every 1,024 records */ - --static rsRetVal persistJournalState(int trySave); -+static rsRetVal persistJournalState(void); - static rsRetVal loadJournalState(void); - - static rsRetVal openJournal(void) { - int r; - DEFiRet; - -- if ((r = sd_journal_open(&j, SD_JOURNAL_LOCAL_ONLY)) < 0) { -- LogError(-r, RS_RET_IO_ERROR, "imjournal: sd_journal_open() failed"); -- iRet = RS_RET_IO_ERROR; -+ if (journalContext.j) { -+ LogMsg(0, RS_RET_OK_WARN, LOG_WARNING, "imjournal: opening journal when already opened.\n"); - } -- if ((r = sd_journal_get_fd(j)) < 0) { -- LogError(-r, RS_RET_IO_ERROR, "imjournal: sd_journal_get_fd() failed"); -+ if ((r = sd_journal_open(&journalContext.j, cs.bRemote? 0 : SD_JOURNAL_LOCAL_ONLY)) < 0) { -+ LogError(-r, RS_RET_IO_ERROR, "imjournal: sd_journal_open() failed"); - iRet = RS_RET_IO_ERROR; - } -+ journalContext.atHead = 1; - RETiRet; - } - - /* trySave shoulod only be true if there is no journald error preceeding this call */ --static void closeJournal(int trySave) { -- if (cs.stateFile) { /* can't persist without a state file */ -- persistJournalState(trySave); -+static void closeJournal(void) { -+ if (!journalContext.j) { -+ LogMsg(0, RS_RET_OK_WARN, LOG_WARNING, "imjournal: closing NULL journal.\n"); - } -- sd_journal_close(j); -+ sd_journal_close(journalContext.j); -+ journalContext.j = NULL; /* setting to NULL here as journald API will not do that for us... */ -+} -+ -+static int journalGetData(const char *field, const void **data, size_t *length) -+{ -+ int ret; -+ -+ ret = sd_journal_get_data(journalContext.j, field, data, length); -+ if (ret == -EADDRNOTAVAIL) { -+ LogError(-ret, RS_RET_ERR, "imjournal: Tried to get data without a 'next' call.\n"); -+ if ((ret = sd_journal_next(journalContext.j)) < 0) { -+ LogError(-ret, RS_RET_ERR, "imjournal: sd_journal_next() failed\n"); -+ } else { -+ ret = sd_journal_get_data(journalContext.j, field, data, length); -+ } -+ } -+ -+ return ret; - } - - -@@ -223,12 +247,84 @@ sanitizeValue(const char *in, size_t len, char **out) - } - - -+/* Read JSON part of single journald message and return it as JSON object -+ */ -+static rsRetVal -+readJSONfromJournalMsg(struct fjson_object **json) -+{ -+ DEFiRet; -+ const void *get; -+ const void *equal_sign; -+ struct fjson_object *jval; -+ size_t l; -+ long prefixlen = 0; -+ -+ CHKmalloc(*json = fjson_object_new_object()); -+ -+ SD_JOURNAL_FOREACH_DATA(journalContext.j, get, l) { -+ char *data; -+ char *name; -+ -+ /* locate equal sign, this is always present */ -+ equal_sign = memchr(get, '=', l); -+ -+ /* ... but we know better than to trust the specs */ -+ if (equal_sign == NULL) { -+ LogError(0, RS_RET_ERR, "SD_JOURNAL_FOREACH_DATA()" -+ "returned a malformed field (has no '='): '%s'", (char*)get); -+ continue; /* skip the entry */ -+ } -+ -+ /* get length of journal data prefix */ -+ prefixlen = ((char *)equal_sign - (char *)get); -+ -+ CHKmalloc(name = strndup(get, prefixlen)); -+ -+ prefixlen++; /* remove '=' */ -+ -+ CHKiRet_Hdlr(sanitizeValue(((const char *)get) + prefixlen, l - prefixlen, &data)) { -+ free (name); -+ FINALIZE; -+ } -+ -+ /* and save them to json object */ -+ jval = fjson_object_new_string((char *)data); -+ fjson_object_object_add(*json, name, jval); -+ free (data); -+ free (name); -+ } -+finalize_it: -+ RETiRet; -+} -+ -+ -+/* Try to obtain current journald cursor and save it to journalContext struct. -+ */ -+static rsRetVal -+updateJournalCursor(void) -+{ -+ DEFiRet; -+ char *c = NULL; -+ int r; -+ -+ if ((r = sd_journal_get_cursor(journalContext.j, &c)) < 0) { -+ LogError(-r, RS_RET_ERR, "imjournal: Could not get journald cursor!\n"); -+ ABORT_FINALIZE(RS_RET_ERR); -+ } -+ /* save journal cursor (at this point we can be sure it is valid) */ -+ free(journalContext.cursor); -+ journalContext.cursor = c; -+finalize_it: -+ RETiRet; -+} -+ -+ - /* enqueue the the journal message into the message queue. - * The provided msg string is not freed - thus must be done - * by the caller. - */ - static rsRetVal --enqMsg(uchar *msg, uchar *pszTag, int iFacility, int iSeverity, struct timeval *tp, struct json_object *json, -+enqMsg(uchar *msg, uchar *pszTag, int iFacility, int iSeverity, struct timeval *tp, struct fjson_object *json, - int sharedJsonProperties) - { - struct syslogTime st; -@@ -267,15 +363,17 @@ int sharedJsonProperties) - STATSCOUNTER_INC(statsCounter.ctrSubmitted, statsCounter.mutCtrSubmitted); - - finalize_it: -- if (iRet == RS_RET_DISCARDMSG) -+ if (iRet == RS_RET_DISCARDMSG) { - STATSCOUNTER_INC(statsCounter.ctrDiscarded, statsCounter.mutCtrDiscarded); -+ } else if (iRet != RS_RET_OK) { -+ LogError(0, RS_RET_ERR, "imjournal: error during enqMsg().\n"); -+ } - - RETiRet; - } - - --/* Read journal log while data are available, each read() reads one -- * record of printk buffer. -+/* Read journal log while data are available, each read() reads one journald record. - */ - static rsRetVal - readjournal(void) -@@ -285,39 +383,32 @@ readjournal(void) - struct timeval tv; - uint64_t timestamp; - -- struct json_object *json = NULL; -+ struct fjson_object *json = NULL; - int r; - - /* Information from messages */ - char *message = NULL; - char *sys_iden; - char *sys_iden_help = NULL; -- char *c = NULL; - - const void *get; - const void *pidget; - size_t length; - size_t pidlength; - -- const void *equal_sign; -- struct json_object *jval; -- size_t l; -- -- long prefixlen = 0; -- - int severity = cs.iDfltSeverity; - int facility = cs.iDfltFacility; - - /* Get message text */ -- if (sd_journal_get_data(j, "MESSAGE", &get, &length) < 0) { -- message = strdup(""); -+ if (journalGetData("MESSAGE", &get, &length) < 0) { -+ CHKmalloc(message = strdup("")); - } else { - CHKiRet(sanitizeValue(((const char *)get) + 8, length - 8, &message)); - } - STATSCOUNTER_INC(statsCounter.ctrRead, statsCounter.mutCtrRead); - - /* Get message severity ("priority" in journald's terminology) */ -- if (sd_journal_get_data(j, "PRIORITY", &get, &length) >= 0) { -+ if (journalGetData("PRIORITY", &get, &length) >= 0) { - if (length == 10) { - severity = ((char *)get)[9] - '0'; - if (severity < 0 || 7 < severity) { -@@ -332,7 +423,7 @@ readjournal(void) - } - - /* Get syslog facility */ -- if (sd_journal_get_data(j, "SYSLOG_FACILITY", &get, &length) >= 0) { -+ if (journalGetData("SYSLOG_FACILITY", &get, &length) >= 0) { - // Note: the journal frequently contains invalid facilities! - if (length == 17 || length == 18) { - facility = ((char *)get)[16] - '0'; -@@ -352,14 +443,14 @@ readjournal(void) - } - - /* Get message identifier, client pid and add ':' */ -- if (sd_journal_get_data(j, "SYSLOG_IDENTIFIER", &get, &length) >= 0) { -+ if (journalGetData("SYSLOG_IDENTIFIER", &get, &length) >= 0) { - CHKiRet(sanitizeValue(((const char *)get) + 18, length - 18, &sys_iden)); - } else { - CHKmalloc(sys_iden = strdup("journal")); - } - - /* trying to get PID, default is "SYSLOG_PID" property */ -- if (sd_journal_get_data(j, pidFieldName, &pidget, &pidlength) >= 0) { -+ if (journalGetData(pidFieldName, &pidget, &pidlength) >= 0) { - char *sys_pid; - int val_ofs; - -@@ -372,7 +463,7 @@ readjournal(void) - free (sys_pid); - } else { - /* this is fallback, "SYSLOG_PID" doesn't exist so trying to get "_PID" property */ -- if (bPidFallBack && sd_journal_get_data(j, "_PID", &pidget, &pidlength) >= 0) { -+ if (bPidFallBack && journalGetData("_PID", &pidget, &pidlength) >= 0) { - char *sys_pid; - int val_ofs; - -@@ -396,55 +487,15 @@ readjournal(void) - ABORT_FINALIZE(RS_RET_OUT_OF_MEMORY); - } - -- json = json_object_new_object(); -- -- SD_JOURNAL_FOREACH_DATA(j, get, l) { -- char *data; -- char *name; -- -- /* locate equal sign, this is always present */ -- equal_sign = memchr(get, '=', l); -- -- /* ... but we know better than to trust the specs */ -- if (equal_sign == NULL) { -- LogError(0, RS_RET_ERR, "SD_JOURNAL_FOREACH_DATA()" -- "returned a malformed field (has no '='): '%s'", (char*)get); -- continue; /* skip the entry */ -- } -- -- /* get length of journal data prefix */ -- prefixlen = ((char *)equal_sign - (char *)get); -- -- name = strndup(get, prefixlen); -- CHKmalloc(name); -- -- prefixlen++; /* remove '=' */ -- -- CHKiRet_Hdlr(sanitizeValue(((const char *)get) + prefixlen, l - prefixlen, &data)) { -- free (name); -- FINALIZE; -- } -- -- /* and save them to json object */ -- jval = json_object_new_string((char *)data); -- json_object_object_add(json, name, jval); -- free (data); -- free (name); -- } -+ CHKiRet(readJSONfromJournalMsg(&json)); - - /* calculate timestamp */ -- if (sd_journal_get_realtime_usec(j, ×tamp) >= 0) { -+ if (sd_journal_get_realtime_usec(journalContext.j, ×tamp) >= 0) { - tv.tv_sec = timestamp / 1000000; - tv.tv_usec = timestamp % 1000000; - } - -- if (cs.bWorkAroundJournalBug) { -- /* save journal cursor (at this point we can be sure it is valid) */ -- if (!sd_journal_get_cursor(j, &c)) { -- free(last_cursor); -- last_cursor = c; -- } -- } -+ iRet = updateJournalCursor(); - - /* submit message */ - enqMsg((uchar *)message, (uchar *) sys_iden_help, facility, severity, &tv, json, 0); -@@ -456,32 +507,22 @@ readjournal(void) - } - - --/* This function gets journal cursor and saves it into state file. -- * If WorkAroundJournalBug option is turned on it does use cursor saved previously. -- * If it is false and if "trySave" is false it skips altogether. -+/* This function saves journal cursor into state file. -+ * It must be checked that stateFile is configured prior to calling this. - */ - static rsRetVal --persistJournalState(int trySave) -+persistJournalState(void) - { - DEFiRet; - FILE *sf = NULL; /* state file */ - char tmp_sf[MAXFNAME]; - size_t n; - -- if (cs.bWorkAroundJournalBug) { -- /* first check that we have valid cursor */ -- if (!last_cursor) { -- ABORT_FINALIZE(RS_RET_OK); -- } -- } else if (trySave) { -- int ret; -- free(last_cursor); -- if ((ret = sd_journal_get_cursor(j, &last_cursor))) { -- LogError(-ret, RS_RET_ERR, "imjournal: sd_journal_get_cursor() failed"); -- last_cursor = NULL; -- ABORT_FINALIZE(RS_RET_ERR); -- } -- } else { /* not trying to get cursor out of invalid journal state */ -+ DBGPRINTF("Persisting journal position, cursor: %s, at head? %d\n", -+ journalContext.cursor, journalContext.atHead); -+ -+ /* first check that we have valid cursor */ -+ if (!journalContext.cursor) { - ABORT_FINALIZE(RS_RET_OK); - } - -@@ -500,7 +541,7 @@ persistJournalState(int trySave) - ABORT_FINALIZE(RS_RET_FOPEN_FAILURE); - } - -- if(fputs(last_cursor, sf) == EOF) { -+ if(fputs(journalContext.cursor, sf) == EOF) { - LogError(errno, RS_RET_IO_ERROR, "imjournal: failed to save cursor to: '%s'", tmp_sf); - ABORT_FINALIZE(RS_RET_IO_ERROR); - } -@@ -541,43 +582,59 @@ persistJournalState(int trySave) - - static rsRetVal skipOldMessages(void); - --#define POLL_TIMEOUT 900000 /* timeout for poll is 900ms */ -- - static rsRetVal --pollJournal(void) -+handleRotation(void) - { - DEFiRet; -- int err; -+ int r; - -- err = sd_journal_wait(j, POLL_TIMEOUT); -- if (err == SD_JOURNAL_INVALIDATE && !reloaded) { -- STATSCOUNTER_INC(statsCounter.ctrRotations, statsCounter.mutCtrRotations); -- closeJournal(0); -+ LogMsg(0, RS_RET_OK, LOG_NOTICE, "imjournal: journal files changed, reloading...\n"); -+ STATSCOUNTER_INC(statsCounter.ctrRotations, statsCounter.mutCtrRotations); -+ closeJournal(); - -- iRet = openJournal(); -- if (iRet != RS_RET_OK) { -- ABORT_FINALIZE(RS_RET_ERR); -- } -+ iRet = openJournal(); -+ if (iRet != RS_RET_OK) { -+ ABORT_FINALIZE(RS_RET_ERR); -+ } - -- /* If we have locally saved cursor there is no need to read it from state file */ -- if (cs.bWorkAroundJournalBug && last_cursor) -- { -- if (sd_journal_seek_cursor(j, last_cursor) != 0) { -- LogError(0, RS_RET_ERR, "imjournal: " -- "couldn't seek to cursor `%s'\n", last_cursor); -- iRet = RS_RET_ERR; -- } -- /* Need to advance because cursor points at last processed message */ -- sd_journal_next(j); -+ /* If we have locally saved cursor there is no need to read it from state file */ -+ if (journalContext.cursor) -+ { -+ if (sd_journal_seek_cursor(journalContext.j, journalContext.cursor) != 0) { -+ LogError(0, RS_RET_ERR, "imjournal: " -+ "couldn't seek to cursor `%s'\n", journalContext.cursor); -+ iRet = RS_RET_ERR; - } -- else if (cs.stateFile) { -- iRet = loadJournalState(); -+ journalContext.atHead = 0; -+ /* Need to advance because cursor points at last processed message */ -+ if ((r = sd_journal_next(journalContext.j)) < 0) { -+ LogError(-r, RS_RET_ERR, "imjournal: sd_journal_next() failed"); -+ iRet = RS_RET_ERR; - } -- LogMsg(0, RS_RET_OK, LOG_NOTICE, "imjournal: journal reloaded..."); -- reloaded = 1; -+ } -+ else if (cs.stateFile) { -+ iRet = loadJournalState(); -+ } -+ journalContext.reloaded = 1; -+ -+finalize_it: -+ RETiRet; -+} -+ -+#define POLL_TIMEOUT 900000 /* timeout for poll is 900ms */ -+ -+static rsRetVal -+pollJournal(void) -+{ -+ DEFiRet; -+ int err; -+ -+ err = sd_journal_wait(journalContext.j, POLL_TIMEOUT); -+ if (err == SD_JOURNAL_INVALIDATE && !journalContext.reloaded) { -+ CHKiRet(handleRotation()); - } - else { -- reloaded = 0; -+ journalContext.reloaded = 0; - } - - finalize_it: -@@ -591,12 +648,13 @@ skipOldMessages(void) - int r; - DEFiRet; - -- if ((r = sd_journal_seek_tail(j)) < 0) { -+ if ((r = sd_journal_seek_tail(journalContext.j)) < 0) { - LogError(-r, RS_RET_ERR, - "imjournal: sd_journal_seek_tail() failed"); - ABORT_FINALIZE(RS_RET_ERR); - } -- if ((r = sd_journal_previous(j)) < 0) { -+ journalContext.atHead = 0; -+ if ((r = sd_journal_previous(journalContext.j)) < 0) { - LogError(-r, RS_RET_ERR, - "imjournal: sd_journal_previous() failed"); - ABORT_FINALIZE(RS_RET_ERR); -@@ -615,6 +673,9 @@ loadJournalState(void) - int r; - FILE *r_sf; - -+ DBGPRINTF("Loading journal position, at head? %d, reloaded? %d\n", -+ journalContext.atHead, journalContext.reloaded); -+ - if (cs.stateFile[0] != '/') { - char *new_stateFile; - if (-1 == asprintf(&new_stateFile, "%s/%s", (char *)glbl.GetWorkDir(), cs.stateFile)) { -@@ -639,13 +700,14 @@ loadJournalState(void) - if ((r_sf = fopen(cs.stateFile, "rb")) != NULL) { - char readCursor[128 + 1]; - if (fscanf(r_sf, "%128s\n", readCursor) != EOF) { -- if (sd_journal_seek_cursor(j, readCursor) != 0) { -+ if (sd_journal_seek_cursor(journalContext.j, readCursor) != 0) { - LogError(0, RS_RET_ERR, "imjournal: " - "couldn't seek to cursor `%s'\n", readCursor); - iRet = RS_RET_ERR; - } else { -+ journalContext.atHead = 0; - char * tmp_cursor = NULL; -- sd_journal_next(j); -+ sd_journal_next(journalContext.j); - /* - * This is resolving the situation when system is after reboot and boot_id - * doesn't match so cursor pointing into "future". -@@ -658,14 +720,15 @@ loadJournalState(void) - * but if cursor has been intentionally compromised it could stop logging even - * with persistent journal. - * */ -- if ((r = sd_journal_get_cursor(j, &tmp_cursor)) < 0) { -+ if ((r = sd_journal_get_cursor(journalContext.j, &tmp_cursor)) < 0) { - LogError(-r, RS_RET_IO_ERROR, "imjournal: " - "loaded invalid cursor, seeking to the head of journal\n"); -- if ((r = sd_journal_seek_head(j)) < 0) { -+ if ((r = sd_journal_seek_head(journalContext.j)) < 0) { - LogError(-r, RS_RET_ERR, "imjournal: " - "sd_journal_seek_head() failed, when cursor is invalid\n"); - iRet = RS_RET_ERR; - } -+ journalContext.atHead = 1; - } - free(tmp_cursor); - } -@@ -680,18 +743,15 @@ loadJournalState(void) - if (iRet != RS_RET_OK && cs.bIgnoreNonValidStatefile) { - /* ignore state file errors */ - iRet = RS_RET_OK; -- LogError(0, NO_ERRCODE, "imjournal: ignoring invalid state file %s", -- cs.stateFile); -+ LogError(0, NO_ERRCODE, "imjournal: ignoring invalid state file %s", cs.stateFile); - if (cs.bIgnorePrevious) { - skipOldMessages(); - } - } - } else { -- LogError(0, RS_RET_FOPEN_FAILURE, "imjournal: " -- "open on state file `%s' failed\n", cs.stateFile); -+ LogError(0, RS_RET_FOPEN_FAILURE, "imjournal: open on state file `%s' failed\n", cs.stateFile); - if (cs.bIgnorePrevious) { -- /* Seek to the very end of the journal and ignore all -- * older messages. */ -+ /* Seek to the very end of the journal and ignore all older messages. */ - skipOldMessages(); - } - } -@@ -704,7 +764,7 @@ static void - tryRecover(void) { - LogMsg(0, RS_RET_OK, LOG_INFO, "imjournal: trying to recover from journal error"); - STATSCOUNTER_INC(statsCounter.ctrRecoveryAttempts, statsCounter.mutCtrRecoveryAttempts); -- closeJournal(0); -+ closeJournal(); - srSleep(10, 0); // do not hammer machine with too-frequent retries - openJournal(); - } -@@ -723,8 +783,7 @@ CODESTARTrunInput - /* Load our position in the journal from the state file. */ - CHKiRet(loadJournalState()); - } else if (cs.bIgnorePrevious) { -- /* Seek to the very end of the journal and ignore all -- * older messages. */ -+ /* Seek to the very end of the journal and ignore all older messages. */ - skipOldMessages(); - } - -@@ -758,7 +817,7 @@ CODESTARTrunInput - while (glbl.GetGlobalInputTermState() == 0) { - int r; - -- r = sd_journal_next(j); -+ r = sd_journal_next(journalContext.j); - if (r < 0) { - LogError(-r, RS_RET_ERR, "imjournal: sd_journal_next() failed"); - tryRecover(); -@@ -766,8 +825,12 @@ CODESTARTrunInput - } - - if (r == 0) { -+ if (journalContext.atHead) { -+ LogMsg(0, RS_RET_OK, LOG_WARNING, "imjournal: " -+ "Journal indicates no msgs when positioned at head.\n"); -+ } - /* No new messages, wait for activity. */ -- if (pollJournal() != RS_RET_OK && !reloaded) { -+ if (pollJournal() != RS_RET_OK && !journalContext.reloaded) { - tryRecover(); - } - continue; -@@ -776,7 +839,7 @@ CODESTARTrunInput - /* - * update journal disk usage before reading the new message. - */ -- const int e = sd_journal_get_usage(j, (uint64_t *)&statsCounter.diskUsageBytes); -+ const int e = sd_journal_get_usage(journalContext.j, (uint64_t *)&statsCounter.diskUsageBytes); - if (e < 0) { - LogError(-e, RS_RET_ERR, "imjournal: sd_get_usage() failed"); - } -@@ -787,21 +850,12 @@ CODESTARTrunInput - } - - count++; -- -- if ((count % J_PROCESS_PERIOD) == 0) { -- /* Give the journal a periodic chance to detect rotated journal files to be cleaned up. */ -- r = sd_journal_process(j); -- if (r < 0) { -- LogError(-r, RS_RET_ERR, "imjournal: sd_journal_process() failed"); -- tryRecover(); -- continue; -- } -- } -+ journalContext.atHead = 0; - - if (cs.stateFile) { /* can't persist without a state file */ - /* TODO: This could use some finer metric. */ - if ((count % cs.iPersistStateInterval) == 0) { -- persistJournalState(1); -+ persistJournalState(); - } - } - } -@@ -825,6 +879,7 @@ CODESTARTbeginCnfLoad - cs.usePid = NULL; - cs.bWorkAroundJournalBug = 1; - cs.bFsync = 0; -+ cs.bRemote = 0; - ENDbeginCnfLoad - - -@@ -881,7 +936,7 @@ BEGINfreeCnf - CODESTARTfreeCnf - free(cs.stateFile); - free(cs.usePid); -- free(last_cursor); -+ free(journalContext.cursor); - statsobj.Destruct(&(statsCounter.stats)); - ENDfreeCnf - -@@ -894,7 +949,10 @@ ENDwillRun - /* close journal */ - BEGINafterRun - CODESTARTafterRun -- closeJournal(1); -+ if (cs.stateFile) { /* can't persist without a state file */ -+ persistJournalState(); -+ } -+ closeJournal(); - ratelimitDestruct(ratelimiter); - ENDafterRun - -@@ -966,6 +1024,8 @@ CODESTARTsetModCnf - cs.bWorkAroundJournalBug = (int) pvals[i].val.d.n; - } else if (!strcmp(modpblk.descr[i].name, "fsync")) { - cs.bFsync = (int) pvals[i].val.d.n; -+ } else if (!strcmp(modpblk.descr[i].name, "remote")) { -+ cs.bRemote = (int) pvals[i].val.d.n; - } else { - dbgprintf("imjournal: program error, non-handled " - "param '%s' in beginCnfLoad\n", modpblk.descr[i].name); -diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c -index 8008f159c4..18e4d25ebb 100644 ---- a/plugins/imjournal/imjournal.c -+++ b/plugins/imjournal/imjournal.c -@@ -3,7 +3,7 @@ - * To test under Linux: - * emmit log message into systemd journal - * -- * Copyright (C) 2008-2017 Adiscon GmbH -+ * Copyright (C) 2008-2019 Adiscon GmbH - * - * This file is part of rsyslog. - * -@@ -676,16 +676,6 @@ loadJournalState(void) - DBGPRINTF("Loading journal position, at head? %d, reloaded? %d\n", - journalContext.atHead, journalContext.reloaded); - -- if (cs.stateFile[0] != '/') { -- char *new_stateFile; -- if (-1 == asprintf(&new_stateFile, "%s/%s", (char *)glbl.GetWorkDir(), cs.stateFile)) { -- LogError(0, RS_RET_OUT_OF_MEMORY, "imjournal: asprintf failed\n"); -- ABORT_FINALIZE(RS_RET_OUT_OF_MEMORY); -- } -- free (cs.stateFile); -- cs.stateFile = new_stateFile; -- } -- - /* if state file not exists (on very first run), skip */ - if (access(cs.stateFile, F_OK|R_OK) == -1 && errno == ENOENT) { - if (cs.bIgnorePrevious) { -@@ -885,6 +875,17 @@ ENDbeginCnfLoad - - BEGINendCnfLoad - CODESTARTendCnfLoad -+ /* bad trick to handle old and new style config all in old-style var */ -+ if(cs.stateFile != NULL && cs.stateFile[0] != '/') { -+ char *new_stateFile; -+ if (-1 == asprintf(&new_stateFile, "%s/%s", (char *)glbl.GetWorkDir(), cs.stateFile)) { -+ LogError(0, RS_RET_OUT_OF_MEMORY, "imjournal: asprintf failed\n"); -+ ABORT_FINALIZE(RS_RET_OUT_OF_MEMORY); -+ } -+ free (cs.stateFile); -+ cs.stateFile = new_stateFile; -+ } -+finalize_it: - ENDendCnfLoad - - -@@ -1032,7 +1033,6 @@ CODESTARTsetModCnf - } - } - -- - finalize_it: - if (pvals != NULL) - cnfparamvalsDestruct(pvals, &modpblk); diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..ae0c305 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,6 @@ +summary: Run all tests +execute: + how: tmt +discover: + how: fmf + diff --git a/rsyslog-8.34.0-sd-service.patch b/rsyslog-8.34.0-sd-service.patch deleted file mode 100644 index f1191d4..0000000 --- a/rsyslog-8.34.0-sd-service.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff -up rsyslog-7.4.1/rsyslog.service.in.orig rsyslog-7.4.1/rsyslog.service.in ---- rsyslog-7.4.1/rsyslog.service.in.orig 2013-06-17 15:28:54.430023493 +0200 -+++ rsyslog-7.4.1/rsyslog.service.in 2013-06-17 15:30:05.874378084 +0200 -@@ -6,7 +6,9 @@ Requires=syslog.socket - - [Service] - Type=notify --ExecStart=@sbindir@/rsyslogd -n -iNONE -+EnvironmentFile=-/etc/sysconfig/rsyslog -+ExecStart=@sbindir@/rsyslogd -n $SYSLOGD_OPTIONS -+UMask=0066 - StandardOutput=null - Restart=on-failure - diff --git a/rsyslog.conf b/rsyslog.conf index b51e844..4486f1f 100644 --- a/rsyslog.conf +++ b/rsyslog.conf @@ -9,19 +9,22 @@ # Where to place auxiliary files global(workDirectory="/var/lib/rsyslog") +#### MODULES #### + # Use default timestamp format module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat") +module(load="imuxsock" # provides support for local system logging (e.g. via logger command) + SysSock.Use="off") # Turn off message reception via local log socket; + # local messages are retrieved through imjournal now. +module(load="imjournal" # provides access to the systemd journal + FileCreateMode="0600" # Quiet warning and ensure privacy + UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from + StateFile="imjournal.state") # File to store the position in the journal + # Include all config files in /etc/rsyslog.d/ include(file="/etc/rsyslog.d/*.conf" mode="optional") -#### MODULES #### - -module(load="imuxsock" # provides support for local system logging (e.g. via logger command) - SysSock.Use="off") # Turn off message reception via local log socket; - # local messages are retrieved through imjournal now. -module(load="imjournal" # provides access to the systemd journal - StateFile="imjournal.state") # File to store the position in the journal #module(load="imklog") # reads kernel messages (the same are read from journald) #module(load="immark") # provides --MARK-- message capability diff --git a/rsyslog.log b/rsyslog.log index b101e32..42b31c8 100644 --- a/rsyslog.log +++ b/rsyslog.log @@ -7,6 +7,6 @@ missingok sharedscripts postrotate - /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true + /usr/bin/systemctl reload rsyslog.service >/dev/null 2>&1 || true endscript } diff --git a/rsyslog.service b/rsyslog.service new file mode 100644 index 0000000..738f087 --- /dev/null +++ b/rsyslog.service @@ -0,0 +1,37 @@ +[Unit] +Description=System Logging Service +;Requires=syslog.socket +Documentation=man:rsyslogd(8) +Documentation=https://www.rsyslog.com/doc/ +Wants=network.target network-online.target +After=network.target network-online.target + +[Service] +Type=notify +EnvironmentFile=-/etc/sysconfig/rsyslog +ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS +ExecReload=/usr/bin/kill -HUP $MAINPID +UMask=0066 +StandardOutput=null +Restart=on-failure +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=net +NoNewPrivileges=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete +LockPersonality=yes +MemoryDenyWriteExecute=yes + + +# Increase the default a bit in order to allow many simultaneous +# files to be monitored, we might need a lot of fds. +LimitNOFILE=16384 + +[Install] +WantedBy=multi-user.target +;Alias=syslog.service diff --git a/rsyslog.spec b/rsyslog.spec index 9c3b6a8..3b67e3f 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -1,30 +1,61 @@ %define rsyslog_statedir %{_sharedstatedir}/rsyslog %define rsyslog_pkidir %{_sysconfdir}/pki/rsyslog %define rsyslog_docdir %{_docdir}/rsyslog -#due to multiple failures of extensive testbench on various archs -#and module requirements of certain tests need to have it disabled, -#tests execution possible locally on properly set up workstation -%global want_testbench 0 +%define qpid_proton_v 0.40.0 +# The following packages are not enabled on rhel: +# hiredis, libdbi, mongodb, rabbitmq +# The omamqp1 plugin is built differently as qpid-proton is not available on rhel +%if 0%{?rhel} +%bcond_with hiredis +%bcond_with libdbi +%bcond_with mongodb +%bcond_with rabbitmq +%else +%bcond_without hiredis +%bcond_without libdbi +%bcond_without mongodb +%bcond_without rabbitmq +%endif + +# Add options to not build with features listed below, +# the default is to build with them. +%bcond_without clickhouse +%bcond_without imdocker +%bcond_without improg +%bcond_without gnutls +%bcond_without openssl +%bcond_without gssapi +%bcond_without omamqp1 +%bcond_without rdkafka +%bcond_without relp +%bcond_without mysql +%bcond_without pgsql +%bcond_without snmp +%bcond_without udpspoof +%bcond_without mmtaghostname Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2002.0 +Version: 8.2510.0 Release: 1%{?dist} -License: (GPLv3+ and ASL 2.0) +License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz -Source1: http://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{version}.tar.gz -Source2: rsyslog.conf -Source3: rsyslog.sysconfig -Source4: rsyslog.log +Source1: rsyslog.conf +Source2: rsyslog.sysconfig +Source3: rsyslog.log +Source4: rsyslog.service +# Add qpid-proton as another source, enable omamqp1 module in a +# separatae sub-package with it statically linked(see rhbz#1713427) +Source5: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz +BuildRequires: make BuildRequires: gcc BuildRequires: autoconf BuildRequires: automake BuildRequires: bison BuildRequires: dos2unix BuildRequires: flex -BuildRequires: libgcrypt-devel BuildRequires: libfastjson-devel >= 0.99.8 BuildRequires: libestr-devel >= 0.1.9 BuildRequires: libtool @@ -33,19 +64,19 @@ BuildRequires: pkgconfig BuildRequires: python3-docutils # make sure systemd is in a version that isn't affected by rhbz#974132 BuildRequires: systemd-devel >= 204-8 +BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel -BuildRequires: qpid-proton-c-devel +BuildRequires: libcap-ng-devel -Requires: logrotate >= 3.5.2 +Recommends: logrotate +Obsoletes: rsyslog-logrotate < 8.2310.0-2 +Provides: rsyslog-logrotate = %{version}-%{release} Requires: bash >= 2.0 %{?systemd_ordering} Provides: syslog Obsoletes: sysklogd < 1.5-11 -# tweak the upstream service file to honour configuration from /etc/sysconfig/rsyslog -Patch0: rsyslog-8.34.0-sd-service.patch - %package crypto Summary: Encryption support Requires: %name = %version-%release @@ -59,11 +90,6 @@ Summary: ElasticSearch output module for rsyslog Requires: %name = %version-%release BuildRequires: libcurl-devel -%package hiredis -Summary: Redis support for rsyslog -Requires: %name = %version-%release -BuildRequires: hiredis-devel - %package mmjsonparse Summary: JSON enhanced logging support Requires: %name = %version-%release @@ -77,75 +103,136 @@ BuildRequires: libestr-devel liblognorm-devel >= 1.0.2 Summary: Message modification module supporting Linux audit format Requires: %name = %version-%release +%package mmfields +Summary: Fields extraction module +Requires: %name = %version-%release + +%if %{with mmtaghostname} +%package mmtaghostname +Summary: Message modification module supporting adding tags +Requires: %name = %version-%release +%endif + +%if %{with snmp} %package mmsnmptrapd Summary: Message modification module for snmptrapd generated messages Requires: %name = %version-%release +%endif -%package libdbi -Summary: Libdbi database support for rsyslog -Requires: %name = %version-%release -BuildRequires: libdbi-devel - +%if %{with mysql} %package mysql Summary: MySQL support for rsyslog Requires: %name = %version-%release BuildRequires: mariadb-connector-c-devel +%endif -%package mongodb -Summary: MongoDB support for rsyslog -Requires: %name = %version-%release -BuildRequires: mongo-c-driver-devel snappy-devel cyrus-sasl-devel - +%if %{with pgsql} %package pgsql Summary: PostgresSQL support for rsyslog Requires: %name = %version-%release BuildRequires: libpq-devel +%endif -%package rabbitmq -Summary: RabbitMQ support for rsyslog -Requires: %name = %version-%release -BuildRequires: librabbitmq-devel >= 0.2 - +%if %{with gssapi} %package gssapi Summary: GSSAPI authentication and encryption support for rsyslog Requires: %name = %version-%release BuildRequires: krb5-devel +%endif +%if %{with relp} %package relp Summary: RELP protocol support for rsyslog Requires: %name = %version-%release BuildRequires: librelp-devel >= 1.2.16 +%endif +%if %{with gnutls} %package gnutls -Summary: TLS protocol support for rsyslog +Summary: TLS protocol support for rsyslog via GnuTLS library Requires: %name = %version-%release BuildRequires: gnutls-devel +%endif +%if %{with openssl} +%package openssl +Summary: TLS protocol support for rsyslog via OpenSSL library +Group: System Environment/Daemons +Requires: %name = %version-%release +Requires: openssl-libs +BuildRequires: openssl-devel +%endif + +%if %{with snmp} %package snmp Summary: SNMP protocol support for rsyslog Requires: %name = %version-%release BuildRequires: net-snmp-devel +%endif +%if %{with udpspoof} %package udpspoof Summary: Provides the omudpspoof module Requires: %name = %version-%release BuildRequires: libnet-devel +%endif +%if %{with omamqp1} %package omamqp1 Summary: Provides the omamqp1 module Requires: %name = %version-%release -BuildRequires: qpid-proton-c-devel +Requires: cyrus-sasl-lib +Requires: openssl-libs +BuildRequires: cmake +BuildRequires: make +BuildRequires: gcc +BuildRequires: gcc-c++ +BuildRequires: cyrus-sasl-devel +BuildRequires: openssl-devel +BuildRequires: python3 +%endif +%if %{with rdkafka} %package kafka Summary: Provides the omkafka module Requires: %name = %version-%release BuildRequires: librdkafka-devel +%endif %package mmkubernetes Summary: Provides the mmkubernetes module Requires: %name = %version-%release BuildRequires: libcurl-devel +%if %{with hiredis} +%package hiredis +Summary: Redis support for rsyslog +Requires: %name = %version-%release +BuildRequires: hiredis-devel +%endif + +%if %{with libdbi} +%package libdbi +Summary: Libdbi database support for rsyslog +Requires: %name = %version-%release +BuildRequires: libdbi-devel +%endif + +%if %{with mongodb} +%package mongodb +Summary: MongoDB support for rsyslog +Requires: %name = %version-%release +BuildRequires: mongo-c-driver-devel snappy-devel cyrus-sasl-devel +%endif + +%if %{with rabbitmq} +%package rabbitmq +Summary: RabbitMQ support for rsyslog +Requires: %name = %version-%release +BuildRequires: librabbitmq-devel >= 0.2 +%endif + + %description Rsyslog is an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, @@ -165,9 +252,6 @@ This subpackage contains documentation for rsyslog. This module provides the capability for rsyslog to feed logs directly into Elasticsearch. -%description hiredis -This module provides output to Redis. - %description mmjsonparse This module provides the capability to recognize and parse JSON enhanced syslog messages. @@ -179,77 +263,151 @@ This module provides the capability to normalize log messages via liblognorm. This module provides message modification supporting Linux audit format in various settings. +%description mmfields +The mmfield module permits to extract fields. Using this module is of special +advantage if a field-based log format is to be processed, like for example CEF +and either a large number of fields is needed or a specific field is used multiple +times inside filters. + +%description mmtaghostname +This module provides message modification for changing or adding the host name. + +%if %{with snmp} %description mmsnmptrapd This message modification module takes messages generated from snmptrapd and modifies them so that they look like they originated from the read originator. +%endif -%description libdbi -This module supports a large number of database systems via -libdbi. Libdbi abstracts the database layer and provides drivers for -many systems. Drivers are available via the libdbi-drivers project. - +%if %{with mysql} %description mysql The rsyslog-mysql package contains a dynamic shared object that will add MySQL database support to rsyslog. +%endif -%description mongodb -The rsyslog-mongodb package contains a dynamic shared object that will add -MongoDB database support to rsyslog. - +%if %{with pgsql} %description pgsql The rsyslog-pgsql package contains a dynamic shared object that will add PostgreSQL database support to rsyslog. +%endif -%description rabbitmq -This module allows rsyslog to send messages to a RabbitMQ server. - +%if %{with gssapi} %description gssapi The rsyslog-gssapi package contains the rsyslog plugins which support GSSAPI authentication and secure connections. GSSAPI is commonly used for Kerberos authentication. +%endif +%if %{with relp} %description relp The rsyslog-relp package contains the rsyslog plugins that provide the ability to receive syslog messages via the reliable RELP protocol. +%endif +%if %{with gnutls} %description gnutls The rsyslog-gnutls package contains the rsyslog plugins that provide the -ability to receive syslog messages via upcoming syslog-transport-tls -IETF standard protocol. +ability to send and receive syslog messages via TCP or RELP using TLS +encryption via GnuTLS library. For details refer to rsyslog doc on imtcp +and omfwd modules. +%endif +%if %{with openssl} +%description openssl +The rsyslog-openssl package contains the rsyslog plugins that provide the +ability to send and receive syslog messages via TCP or RELP using TLS +encryption via OpenSSL library. For details refer to rsyslog doc on imtcp +and omfwd modules. +%endif + +%if %{with snmp} %description snmp The rsyslog-snmp package contains the rsyslog plugin that provides the ability to send syslog messages as SNMPv1 and SNMPv2c traps. +%endif +%if %{with udpspoof} %description udpspoof This module is similar to the regular UDP forwarder, but permits to spoof the sender address. Also, it enables to circle through a number of source ports. +%endif +%if %{with omamqp1} %description omamqp1 -The omamqp1 output module can be used to send log messages via an AMQP +The omamqp1 output module can be used to send log messages via an AMQP 1.0-compatible messaging bus. +%endif +%if %{with rdkafka} %description kafka -The rsyslog-kafka package provides module for Apache Kafka output. +The rsyslog-kafka package provides module for Apache Kafka output. +%endif %description mmkubernetes -The rsyslog-mmkubernetes package provides module for adding kubernetes -container metadata. +The rsyslog-mmkubernetes package provides module for adding kubernetes +container metadata. + +%if %{with hiredis} +%description hiredis +This module provides output to Redis. +%endif + +%if %{with libdbi} +%description libdbi +This module supports a large number of database systems via +libdbi. Libdbi abstracts the database layer and provides drivers for +many systems. Drivers are available via the libdbi-drivers project. +%endif + +%if %{with mongodb} +%description mongodb +The rsyslog-mongodb package contains a dynamic shared object that will add +MongoDB database support to rsyslog. +%endif + +%if %{with rabbitmq} +%description rabbitmq +This module allows rsyslog to send messages to a RabbitMQ server. +%endif %prep -# set up rsyslog-doc sources -%setup -q -a 1 -T -c -rm -r LICENSE README.md source build/objects.inv -mv build doc # set up rsyslog sources %setup -q -D -%patch0 -p1 -autoreconf -iv +%if %{with omamqp1} +# Unpack qpid-proton +%setup -q -D -T -b 5 +%endif %build +%ifarch sparc64 +#sparc64 need big PIC +export CFLAGS="$RPM_OPT_FLAGS -fPIC" +%else +export CFLAGS="$RPM_OPT_FLAGS -fpic" +%endif + +%if %{with omamqp1} +# build the proton first +( + cd %{_builddir}/qpid-proton-%{qpid_proton_v} + mkdir bld + cd bld + + # Need ENABLE_FUZZ_TESTING=NO to avoid a link failure + # Modern approach for Python discovery in CMake + cmake .. \ + -DBUILD_BINDINGS="" \ + -DBUILD_STATIC_LIBS=YES \ + -DENABLE_FUZZ_TESTING=NO \ + -DPython_FIND_STRATEGY=LOCATION \ + -DPython_ROOT_DIR=/usr \ + -DCMAKE_AR="/usr/bin/gcc-ar" -DCMAKE_NM="/usr/bin/gcc-nm" -DCMAKE_RANLIB="/usr/bin/gcc-ranlib" + make -j8 +) +%endif + %ifarch sparc64 #sparc64 need big PIE export CFLAGS="$RPM_OPT_FLAGS -fPIE" @@ -258,57 +416,106 @@ export CFLAGS="$RPM_OPT_FLAGS -fpie" %endif export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" +%if %{with hiredis} # the hiredis-devel package doesn't provide a pkg-config file export HIREDIS_CFLAGS=-I/usr/include/hiredis export HIREDIS_LIBS="-L%{_libdir} -lhiredis" +%endif + +sed -i 's/%{version}/%{version}-%{release}/g' configure.ac + +autoreconf -if %configure \ --prefix=/usr \ --disable-static \ -%if %{want_testbench} - --enable-testbench \ + --disable-testbench \ +%if %{with clickhouse} + --enable-clickhouse \ +%endif +%if %{with imdocker} + --enable-imdocker \ +%endif +%if %{with improg} + --enable-improg \ +%endif + --enable-libcap-ng \ +%if %{with libdbi} + --enable-libdbi \ +%endif +%if %{with hiredis} + --enable-omhiredis \ +%endif +%if %{with mongodb} + --enable-ommongodb \ +%endif +%if %{with rabbitmq} + --enable-omrabbitmq \ +%endif +%if %{with omamqp1} + --enable-omamqp1 PROTON_PROACTOR_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_PROACTOR_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ %endif --enable-elasticsearch \ - --enable-clickhouse \ --enable-generate-man-pages \ +%if %{with gnutls} --enable-gnutls \ +%endif +%if %{with openssl} + --enable-openssl \ +%endif +%if %{with gssapi} --enable-gssapi-krb5 \ - --enable-imdiag \ - --enable-imdocker \ +%endif --enable-imfile \ --enable-imjournal \ - --enable-improg \ +%if %{with rdkafka} + --enable-imkafka \ + --enable-omkafka \ +%endif --enable-impstats \ --enable-imptcp \ - --enable-libdbi \ --enable-mail \ --enable-mmanon \ --enable-mmaudit \ --enable-mmcount \ + --enable-mmfields \ --enable-mmkubernetes \ --enable-mmjsonparse \ --enable-mmnormalize \ +%if %{with mmtaghostname} + --enable-mmtaghostname \ +%endif +%if %{with snmp} --enable-mmsnmptrapd \ +%endif + --enable-mmutf8fix \ +%if %{with mysql} --enable-mysql \ - --enable-omamqp1 \ - --enable-omhiredis \ +%endif --enable-omhttp \ --enable-omjournal \ - --enable-ommongodb \ --enable-omprog \ - --enable-omrabbitmq \ --enable-omstdout \ +%if %{with udpspoof} --enable-omudpspoof \ +%endif --enable-omuxsock \ +%if %{with pgsql} --enable-pgsql \ +%endif --enable-pmaixforwardedfrom \ --enable-pmcisconames \ --enable-pmlastmsg \ --enable-pmsnare \ +%if %{with relp} --enable-relp \ +%endif +%if %{with snmp} --enable-snmp \ +%endif --enable-unlimited-select \ --enable-usertools \ - --enable-omkafka + --disable-libgcrypt \ + --enable-openssl_crypto_provider make V=1 @@ -320,16 +527,25 @@ make V=1 DESTDIR=%{buildroot} install install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -d -m 755 %{buildroot}%{_sysconfdir}/logrotate.d +install -d -m 755 %{buildroot}%{_unitdir} install -d -m 755 %{buildroot}%{_sysconfdir}/rsyslog.d install -d -m 700 %{buildroot}%{rsyslog_statedir} install -d -m 700 %{buildroot}%{rsyslog_pkidir} install -d -m 755 %{buildroot}%{rsyslog_docdir}/html -install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/rsyslog.conf -install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog -install -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog +install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/rsyslog.conf +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog +install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog +install -p -m 644 %{SOURCE4} %{buildroot}%{_unitdir}/rsyslog.service + +%if %{with mysql} install -p -m 644 plugins/ommysql/createDB.sql %{buildroot}%{rsyslog_docdir}/mysql-createDB.sql +%endif + +%if %{with pgsql} install -p -m 644 plugins/ompgsql/createDB.sql %{buildroot}%{rsyslog_docdir}/pgsql-createDB.sql +%endif + dos2unix tools/recover_qi.pl install -p -m 644 tools/recover_qi.pl %{buildroot}%{rsyslog_docdir}/recover_qi.pl install -p -m 644 contrib/mmkubernetes/*.rulebase %{buildroot}%{rsyslog_docdir} @@ -337,8 +553,6 @@ install -p -m 644 contrib/mmkubernetes/*.rulebase %{buildroot}%{rsyslog_docdir} cp -r doc/* %{buildroot}%{rsyslog_docdir}/html # get rid of libtool libraries rm -f %{buildroot}%{_libdir}/rsyslog/*.la -# get rid of socket activation by default -sed -i '/^Alias/s/^/;/;/^Requires=syslog.socket/s/^/;/' %{buildroot}%{_unitdir}/rsyslog.service # imdiag and liboverride is only used for testing rm -f %{buildroot}%{_libdir}/rsyslog/imdiag.so rm -f %{buildroot}%{_libdir}/rsyslog/liboverride_gethostname.so @@ -361,10 +575,14 @@ done %{!?_licensedir:%global license %%doc} %license COPYING* %doc AUTHORS ChangeLog README.md -%{rsyslog_docdir} %exclude %{rsyslog_docdir}/html +%exclude %{rsyslog_docdir}/recover_qi.pl +%if %{with mysql} %exclude %{rsyslog_docdir}/mysql-createDB.sql +%endif +%if %{with pgsql} %exclude %{rsyslog_docdir}/pgsql-createDB.sql +%endif %dir %{_libdir}/rsyslog %dir %{_sysconfdir}/rsyslog.d %dir %{rsyslog_statedir} @@ -377,12 +595,12 @@ done %config(noreplace) %{_sysconfdir}/sysconfig/rsyslog %config(noreplace) %{_sysconfdir}/logrotate.d/rsyslog # plugins -%{_libdir}/rsyslog/imdocker.so +%{_libdir}/rsyslog/fmhash.so +%{_libdir}/rsyslog/fmhttp.so %{_libdir}/rsyslog/imfile.so %{_libdir}/rsyslog/imjournal.so %{_libdir}/rsyslog/imklog.so %{_libdir}/rsyslog/immark.so -%{_libdir}/rsyslog/improg.so %{_libdir}/rsyslog/impstats.so %{_libdir}/rsyslog/imptcp.so %{_libdir}/rsyslog/imtcp.so @@ -398,7 +616,8 @@ done %{_libdir}/rsyslog/mmanon.so %{_libdir}/rsyslog/mmcount.so %{_libdir}/rsyslog/mmexternal.so -%{_libdir}/rsyslog/omclickhouse.so +%{_libdir}/rsyslog/mmleefparse.so +%{_libdir}/rsyslog/mmutf8fix.so %{_libdir}/rsyslog/omhttp.so %{_libdir}/rsyslog/omjournal.so %{_libdir}/rsyslog/ommail.so @@ -410,83 +629,322 @@ done %{_libdir}/rsyslog/pmcisconames.so %{_libdir}/rsyslog/pmlastmsg.so %{_libdir}/rsyslog/pmsnare.so -%{_libdir}/rsyslog/fmhttp.so -%{_libdir}/rsyslog/fmhash.so +%if %{with imdocker} +%{_libdir}/rsyslog/imdocker.so +%endif +%if %{with improg} +%{_libdir}/rsyslog/improg.so +%endif +%if %{with clickhouse} +%{_libdir}/rsyslog/omclickhouse.so +%endif %files crypto %{_bindir}/rscryutil %{_mandir}/man1/rscryutil.1.gz -%{_libdir}/rsyslog/lmcry_gcry.so +%{_libdir}/rsyslog/lmcry_ossl.so %files doc -%doc %{rsyslog_docdir}/html +%{rsyslog_docdir}/html +%{rsyslog_docdir}/recover_qi.pl %files elasticsearch %{_libdir}/rsyslog/omelasticsearch.so -%files hiredis -%{_libdir}/rsyslog/omhiredis.so - -%files libdbi -%{_libdir}/rsyslog/omlibdbi.so - %files mmaudit %{_libdir}/rsyslog/mmaudit.so +%files mmfields +%{_libdir}/rsyslog/mmfields.so + %files mmjsonparse %{_libdir}/rsyslog/mmjsonparse.so %files mmnormalize %{_libdir}/rsyslog/mmnormalize.so +%files mmtaghostname +%{_libdir}/rsyslog/mmtaghostname.so + +%if %{with snmp} %files mmsnmptrapd %{_libdir}/rsyslog/mmsnmptrapd.so +%endif +%if %{with mysql} %files mysql %doc %{rsyslog_docdir}/mysql-createDB.sql %{_libdir}/rsyslog/ommysql.so +%endif -%files mongodb -%{_bindir}/logctl -%{_libdir}/rsyslog/ommongodb.so - +%if %{with pgsql} %files pgsql %doc %{rsyslog_docdir}/pgsql-createDB.sql %{_libdir}/rsyslog/ompgsql.so +%endif -%files rabbitmq -%{_libdir}/rsyslog/omrabbitmq.so - +%if %{with gssapi} %files gssapi %{_libdir}/rsyslog/lmgssutil.so %{_libdir}/rsyslog/imgssapi.so %{_libdir}/rsyslog/omgssapi.so +%endif +%if %{with relp} %files relp %{_libdir}/rsyslog/imrelp.so %{_libdir}/rsyslog/omrelp.so +%endif +%if %{with gnutls} %files gnutls %{_libdir}/rsyslog/lmnsd_gtls.so +%endif +%if %{with openssl} +%files openssl +%{_libdir}/rsyslog/lmnsd_ossl.so +%endif + +%if %{with snmp} %files snmp %{_libdir}/rsyslog/omsnmp.so +%endif +%if %{with udpspoof} %files udpspoof %{_libdir}/rsyslog/omudpspoof.so +%endif +%if %{with omamqp1} %files omamqp1 %{_libdir}/rsyslog/omamqp1.so +%endif +%if %{with rdkafka} %files kafka +%{_libdir}/rsyslog/imkafka.so %{_libdir}/rsyslog/omkafka.so +%endif %files mmkubernetes %{_libdir}/rsyslog/mmkubernetes.so %doc %{rsyslog_docdir}/k8s_filename.rulebase %doc %{rsyslog_docdir}/k8s_container_name.rulebase +%if %{with hiredis} +%files hiredis +%{_libdir}/rsyslog/omhiredis.so +%endif + +%if %{with libdbi} +%files libdbi +%{_libdir}/rsyslog/omlibdbi.so +%endif + +%if %{with mongodb} +%files mongodb +%{_bindir}/logctl +%{_libdir}/rsyslog/ommongodb.so +%endif + +%if %{with rabbitmq} +%files rabbitmq +%{_libdir}/rsyslog/omrabbitmq.so +%endif + + %changelog +* Mon Oct 20 2025 Attila Lakatos - 8.2510.0-1 +- Rebase to 8.2510.0 + Resolves: rhbz#2404131 +- imjournal open error handling fix + Resolves: rhbz#2375742 +- Add mmleefparse module to base package + +* Fri Sep 05 2025 Attila Lakatos - 8.2508.0-1 +- Rebase to 8.2508.0 + Resolves: rhbz#2392918 + +* Fri Jul 25 2025 Fedora Release Engineering - 8.2506.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Jun 12 2025 Attila Lakatos - 8.2506.0-1 +- Rebase to 8.2506.0 + Resolves: rhbz#2347628 + +* Tue Jan 21 2025 Attila Lakatos - 8.2412.0-3 +- Fix build problem by resolving -Wincompatible-pointer-types error + +* Sat Jan 18 2025 Fedora Release Engineering - 8.2412.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Thu Dec 05 2024 Attila Lakatos - 8.2412.0-1 +- Rebase to 8.2412.0 +- Harden rsyslog service unit +- Disable openssl engines support + Resolves: rhbz#2320050 + +* Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 +- Rebuild package + Resolves: rhbz#2316361 + +* Wed Aug 21 2024 Attila Lakatos - 8.2408.0-1 +- Rebase to 8.2408.0 + Resolves: rhbz#2266329 + Resolves: rhbz#2301246 + Resolves: rhbz#2305398 + +* Fri Jul 19 2024 Fedora Release Engineering - 8.2312.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed May 29 2024 Orion Poplawski - 8.2312.0-3 +- Explicitly set imjournal FileCreateMode to quiet warning + +* Sat May 11 2024 Kevin Fenzi - 8.2312.0-2 +- rebuild for hiredis soname bump + +* Mon Feb 12 2024 Attila Lakatos - 8.2312.0-1 +- Rebase to 8.2312.0 + resolves: rhbz#2232275 + +* Fri Jan 26 2024 Fedora Release Engineering - 8.2310.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 8.2310.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jan 04 2024 Attila Lakatos - 8.2310.0-2 +- Move rsyslog related logrotate config to the base package + resolves: rhbz#2242243 + +* Fri Aug 25 2023 Attila Lakatos - 8.2310.0-1 +- Rebase to 8.2310.0 + resolves: rhbz#2232275 + +* Wed Aug 16 2023 Stewart Smith - 8.2306.0-4 +- Add mmtaghostname module as a subpackage + +* Fri Jul 21 2023 Fedora Release Engineering - 8.2306.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jul 15 2023 Yaroslav Fedevych - 8.2306.0-2 +- Specify qpid-proton's source as full URL to fix isolated builds + +* Wed Jun 21 2023 Attila Lakatos - 8.2306.0-1 +- rebase to 8.2306.0 + resolves: rhbz#2151339 + resolves: rhbz#2151092 + +* Wed May 10 2023 Todd Zullinger - 8.2210.0-5 +- Use 'systemctl reload' in logrotate script + +* Fri Jan 20 2023 Fedora Release Engineering - 8.2210.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Jan 17 2023 Attila Lakatos - 8.2210.0-3 +- Remove CAP_PERFMON from the capability set +- Add CAP_DAC_OVERRIDE to the capability set + +* Fri Dec 16 2022 Attila Lakatos - 8.2210.0-2 +- Move all if rhel feature conditions to bcond +- Move to bcond: rdkafka, relp, mysql, pgsql, gssapi, gnutls, udpspoof, omamqp1 +- Move to bcond: clickhouse, imdocker, improg + +* Wed Nov 09 2022 Attila Lakatos - 8.2210.0-1 +- rebase to 8.2210.0 + resolves: rhbz#2097173 +- Drop capabilities to the necessary set via libcap-ng + resolves: rhbz#2127403 + +* Wed Jul 27 2022 Attila Lakatos - 8.2204.0-3 +- Restore default omfile template + resolves: rhbz#2088618 + +* Sat Jul 23 2022 Fedora Release Engineering - 8.2204.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon May 09 2022 Attila Lakatos - 8.2204.0-1 +- rebase to 8.2204.0 + resolves: rhbz#1951970 +- CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server + resolves: rhbz#2082302 + +* Mon Jan 24 2022 Attila Lakatos - 8.2102.0-10 +- Rebuild package with bundled qpid-proton + resolves: rhbz#2042940 + +* Fri Jan 21 2022 Fedora Release Engineering - 8.2102.0-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Oct 06 2021 Davide Cavalca - 8.2102.0-8 +- Split out logrotate config and dependency into a subpackage + resolves: rhbz#1992153 + +* Wed Sep 15 2021 Attila Lakatos - 8.2102.0-7 +- Enable mmfields plugin + +* Tue Sep 14 2021 Sahana Prasad - 8.2102.0-6 +- Rebuilt with OpenSSL 3.0.0 + +* Wed Aug 25 2021 Attila Lakatos - 8.2102.0-5 +- Enable openssl +- Do not set default template for omfile + resolves: rhbz#1985195 + +* Tue Jul 27 2021 Pavel Raiskup - 8.2102.0-4 +- reorder the rsyslog.conf to simplify the rsyslog.d configuration (#1985202) + +* Fri Jul 23 2021 Fedora Release Engineering - 8.2102.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Mar 17 2021 Attila Lakatos - 8.2102.0-2 +- Remove rsyslog-recover-qi.pl from bindir, so it does not add dep on /usr/bin/perl + resolves: rhbz#1939556 + +* Wed Mar 03 2021 Attila Lakatos - 8.2102.0-1 +- rebase to upstream version 8.2102.0 + resolves: rhbz#1905363 +- enable additional plugins: imkafka, mmutf8fix + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 8.2010.0-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Mon Feb 08 2021 Pavel Raiskup - 8.2010.0-3 +- rebuild for libpq ABI fix rhbz#1908268 + +* Wed Jan 27 2021 Fedora Release Engineering - 8.2010.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Nov 25 2020 Attila Lakatos - 8.2010.0-1 +- rebase to upstream version 8.2010.0 + resolves: rhbz#1890330 + +* Fri Sep 18 2020 Attila Lakatos - 8.2008.0-2 +- rebuild package + +* Thu Sep 17 2020 Attila Lakatos - 8.2008.0-1 +- rebase to upstream version 8.2008.0 + resolves: rhbz#1829092 + resolves: rhbz#1823862 + resolves: rhbz#1876773 +- add service file back(upstream does not ship it anymore) + +* Thu Aug 27 2020 Josef Řídký - 8.2002.0-5 +- Rebuilt for new net-snmp release + +* Thu Aug 20 2020 Attila Lakatos - 8.2002.0-4 +- enable configuration reload in the service + resolves: rhbz#1868636 + +* Sat Aug 01 2020 Fedora Release Engineering - 8.2002.0-3 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 29 2020 Fedora Release Engineering - 8.2002.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Fri Mar 27 2020 Jiri Vymazal - 8.2002.0-1 - rebase to upstream version 8.2002.0 resolves: rhbz#1807097 @@ -639,7 +1097,7 @@ done * Tue Apr 18 2017 Radovan Sroka - 8.26.0-1 - rebase to 8.26.0 - added doc patch rhbz#1436113 -- dropped chdir patch, https://github.com/rsyslog/rsyslog/pull/1420 +- dropped chdir patch, https://github.com/rsyslog/rsyslog/pull/1420 - moved dependency libgcrypt to rsyslog core * Wed Mar 01 2017 Jiri Vymazal - 8.25.0-2 @@ -693,7 +1151,7 @@ done * Tue Dec 20 2016 Radovan Sroka - 8.23.0-1 - rebase to 8.23.0 -- change build requires from libfastjson to libfastjson-devel +- change build requires from libfastjson to libfastjson-devel * Thu Nov 10 2016 Tomas Sykora 8.22.0-1 - rebase to 8.22.0 @@ -702,7 +1160,7 @@ done * Wed Oct 05 2016 Radovan Sroka 8.21.0-1 - rebase to 8.21.0 -- dropped rsyslog-8.12.0-gnutls-detection.patch +- dropped rsyslog-8.12.0-gnutls-detection.patch - dropped rsyslog-8.8.0-immutable-json-props.patch - remove from specs but nor from git - could be useful in future diff --git a/sources b/sources index 920af80..1294997 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (rsyslog-8.2002.0.tar.gz) = a01bb2f67d21ab6d96dd1302bc351b509892834ef44956983db912a63ba23201653ca1e6b176a574c47568665b4d92579bb8bb0fe6911646bc841a3754c2754f -SHA512 (rsyslog-doc-8.2002.0.tar.gz) = 5d6bd8fe09b49644f000416c87c8600cd3df3facb07845afd85012279df203a44b234e94a7be90ad83709d5f2ad1a2bf8cb51571c5c0cd76383f76f81455945e +SHA512 (rsyslog-8.2510.0.tar.gz) = d2e693fd8c7112e4ccc36ea6fbb19909df885e7cb2778e95c04b7c5e9db8240224decfee52308a46865b7deffcf1e31ade0104c90d84b768a4dece15e5ea190e +SHA512 (qpid-proton-0.40.0.tar.gz) = 3e7fe56ca1423f45f71d81f5e1d6ec5f21c073cc580628e12a8dbd545a86805b7312834e0d1234dde43797633d575ed639f21a96239b217500cc0a824482aae3 diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/tests/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf new file mode 100644 index 0000000..a90b249 --- /dev/null +++ b/tests/got-audit/main.fmf @@ -0,0 +1,10 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit + diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh new file mode 100755 index 0000000..03761a1 --- /dev/null +++ b/tests/got-audit/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/rsyslog/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlServiceStart rsyslog + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID rsyslog.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore rsyslog + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/main.fmf b/tests/main.fmf new file mode 100644 index 0000000..f225a72 --- /dev/null +++ b/tests/main.fmf @@ -0,0 +1,2 @@ +test: ./runtest.sh +framework: beakerlib