diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.gitignore b/.gitignore index cef7fab..f331443 100644 --- a/.gitignore +++ b/.gitignore @@ -94,12 +94,3 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2310.0.tar.gz /rsyslog-8.2312.0.tar.gz /rsyslog-doc-8.2312.0.tar.gz -/rsyslog-8.2408.0.tar.gz -/rsyslog-doc-8.2408.0.tar.gz -/rsyslog-8.2412.0.tar.gz -/rsyslog-doc-8.2412.0.tar.gz -/rsyslog-8.2506.0.tar.gz -/rsyslog-doc-8.2506.0.tar.gz -/rsyslog-8.2508.0.tar.gz -/qpid-proton-0.40.0.tar.gz -/rsyslog-8.2510.0.tar.gz diff --git a/openssl3-compatibility.patch b/openssl3-compatibility.patch new file mode 100644 index 0000000..c86fe23 --- /dev/null +++ b/openssl3-compatibility.patch @@ -0,0 +1,83 @@ +diff -up ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig ./qpid-proton-0.34.0/c/src/ssl/openssl.c +--- ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig 2021-06-01 09:29:27.976842727 +0200 ++++ ./qpid-proton-0.34.0/c/src/ssl/openssl.c 2021-06-01 09:31:05.232015887 +0200 +@@ -353,65 +353,6 @@ static int verify_callback(int preverify + return preverify_ok; + } + +-// This was introduced in v1.1 +-#if OPENSSL_VERSION_NUMBER < 0x10100000 +-int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) +-{ +- dh->p = p; +- dh->q = q; +- dh->g = g; +- return 1; +-} +-#endif +- +-// this code was generated using the command: +-// "openssl dhparam -C -2 2048" +-static DH *get_dh2048(void) +-{ +- static const unsigned char dhp_2048[]={ +- 0xAE,0xF7,0xE9,0x66,0x26,0x7A,0xAC,0x0A,0x6F,0x1E,0xCD,0x81, +- 0xBD,0x0A,0x10,0x7E,0xFA,0x2C,0xF5,0x2D,0x98,0xD4,0xE7,0xD9, +- 0xE4,0x04,0x8B,0x06,0x85,0xF2,0x0B,0xA3,0x90,0x15,0x56,0x0C, +- 0x8B,0xBE,0xF8,0x48,0xBB,0x29,0x63,0x75,0x12,0x48,0x9D,0x7E, +- 0x7C,0x24,0xB4,0x3A,0x38,0x7E,0x97,0x3C,0x77,0x95,0xB0,0xA2, +- 0x72,0xB6,0xE9,0xD8,0xB8,0xFA,0x09,0x1B,0xDC,0xB3,0x80,0x6E, +- 0x32,0x0A,0xDA,0xBB,0xE8,0x43,0x88,0x5B,0xAB,0xC3,0xB2,0x44, +- 0xE1,0x95,0x85,0x0A,0x0D,0x13,0xE2,0x02,0x1E,0x96,0x44,0xCF, +- 0xA0,0xD8,0x46,0x32,0x68,0x63,0x7F,0x68,0xB3,0x37,0x52,0xCE, +- 0x3A,0x4E,0x48,0x08,0x7F,0xD5,0x53,0x00,0x59,0xA8,0x2C,0xCB, +- 0x51,0x64,0x3D,0x5F,0xEF,0x0E,0x5F,0xE6,0xAF,0xD9,0x1E,0xA2, +- 0x35,0x64,0x37,0xD7,0x4C,0xC9,0x24,0xFD,0x2F,0x75,0xBB,0x3A, +- 0x15,0x82,0x76,0x4D,0xC2,0x8B,0x1E,0xB9,0x4B,0xA1,0x33,0xCF, +- 0xAA,0x3B,0x7C,0xC2,0x50,0x60,0x6F,0x45,0x69,0xD3,0x6B,0x88, +- 0x34,0x9B,0xE4,0xF8,0xC6,0xC7,0x5F,0x10,0xA1,0xBA,0x01,0x8C, +- 0xDA,0xD1,0xA3,0x59,0x9C,0x97,0xEA,0xC3,0xF6,0x02,0x55,0x5C, +- 0x92,0x1A,0x39,0x67,0x17,0xE2,0x9B,0x27,0x8D,0xE8,0x5C,0xE9, +- 0xA5,0x94,0xBB,0x7E,0x16,0x6F,0x53,0x5A,0x6D,0xD8,0x03,0xC2, +- 0xAC,0x7A,0xCD,0x22,0x98,0x8E,0x33,0x2A,0xDE,0xAB,0x12,0xC0, +- 0x0B,0x7C,0x0C,0x20,0x70,0xD9,0x0B,0xAE,0x0B,0x2F,0x20,0x9B, +- 0xA4,0xED,0xFD,0x49,0x0B,0xE3,0x4A,0xF6,0x28,0xB3,0x98,0xB0, +- 0x23,0x1C,0x09,0x33, +- }; +- static const unsigned char dhg_2048[]={ +- 0x02, +- }; +- DH *dh = DH_new(); +- BIGNUM *dhp_bn, *dhg_bn; +- +- if (dh == NULL) +- return NULL; +- dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL); +- dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL); +- if (dhp_bn == NULL || dhg_bn == NULL +- || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) { +- DH_free(dh); +- BN_free(dhp_bn); +- BN_free(dhg_bn); +- return NULL; +- } +- return dh; +-} +- + typedef struct { + char *id; + SSL_SESSION *session; +@@ -542,13 +483,6 @@ static bool pni_init_ssl_domain( pn_ssl_ + domain->default_seclevel = SSL_CTX_get_security_level(domain->ctx); + # endif + +- DH *dh = get_dh2048(); +- if (dh) { +- SSL_CTX_set_tmp_dh(domain->ctx, dh); +- DH_free(dh); +- SSL_CTX_set_options(domain->ctx, SSL_OP_SINGLE_DH_USE); +- } +- + return true; + } + diff --git a/plans/main.fmf b/plans/main.fmf deleted file mode 100644 index ae0c305..0000000 --- a/plans/main.fmf +++ /dev/null @@ -1,6 +0,0 @@ -summary: Run all tests -execute: - how: tmt -discover: - how: fmf - diff --git a/rsyslog.conf b/rsyslog.conf index 4486f1f..f2c718e 100644 --- a/rsyslog.conf +++ b/rsyslog.conf @@ -19,7 +19,6 @@ module(load="imuxsock" # provides support for local system logging (e.g. via # local messages are retrieved through imjournal now. module(load="imjournal" # provides access to the systemd journal FileCreateMode="0600" # Quiet warning and ensure privacy - UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from StateFile="imjournal.state") # File to store the position in the journal # Include all config files in /etc/rsyslog.d/ diff --git a/rsyslog.service b/rsyslog.service index 738f087..9c13b1d 100644 --- a/rsyslog.service +++ b/rsyslog.service @@ -3,8 +3,6 @@ Description=System Logging Service ;Requires=syslog.socket Documentation=man:rsyslogd(8) Documentation=https://www.rsyslog.com/doc/ -Wants=network.target network-online.target -After=network.target network-online.target [Service] Type=notify @@ -14,19 +12,6 @@ ExecReload=/usr/bin/kill -HUP $MAINPID UMask=0066 StandardOutput=null Restart=on-failure -RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX -RestrictNamespaces=net -NoNewPrivileges=yes -ProtectControlGroups=yes -ProtectHome=read-only -ProtectKernelModules=yes -ProtectKernelTunables=yes -RestrictSUIDSGID=yes -SystemCallArchitectures=native -SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete -LockPersonality=yes -MemoryDenyWriteExecute=yes - # Increase the default a bit in order to allow many simultaneous # files to be monitored, we might need a lot of fds. diff --git a/rsyslog.spec b/rsyslog.spec index 3b67e3f..1db079d 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -1,7 +1,7 @@ %define rsyslog_statedir %{_sharedstatedir}/rsyslog %define rsyslog_pkidir %{_sysconfdir}/pki/rsyslog %define rsyslog_docdir %{_docdir}/rsyslog -%define qpid_proton_v 0.40.0 +%define qpid_proton_v 0.39.0 # The following packages are not enabled on rhel: # hiredis, libdbi, mongodb, rabbitmq # The omamqp1 plugin is built differently as qpid-proton is not available on rhel @@ -36,18 +36,19 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2510.0 -Release: 1%{?dist} +Version: 8.2312.0 +Release: 5%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz -Source1: rsyslog.conf -Source2: rsyslog.sysconfig -Source3: rsyslog.log -Source4: rsyslog.service +Source1: http://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{version}.tar.gz +Source2: rsyslog.conf +Source3: rsyslog.sysconfig +Source4: rsyslog.log +Source5: rsyslog.service # Add qpid-proton as another source, enable omamqp1 module in a # separatae sub-package with it statically linked(see rhbz#1713427) -Source5: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz +Source6: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz BuildRequires: make BuildRequires: gcc @@ -56,6 +57,7 @@ BuildRequires: automake BuildRequires: bison BuildRequires: dos2unix BuildRequires: flex +BuildRequires: libgcrypt-devel BuildRequires: libfastjson-devel >= 0.99.8 BuildRequires: libestr-devel >= 0.1.9 BuildRequires: libtool @@ -161,6 +163,7 @@ Group: System Environment/Daemons Requires: %name = %version-%release Requires: openssl-libs BuildRequires: openssl-devel +BuildRequires: openssl-devel-engine %endif %if %{with snmp} @@ -372,12 +375,16 @@ This module allows rsyslog to send messages to a RabbitMQ server. %endif %prep +# set up rsyslog-doc sources +%setup -q -a 1 -T -c +rm -r LICENSE README.md source build/objects.inv +mv build doc # set up rsyslog sources %setup -q -D %if %{with omamqp1} # Unpack qpid-proton -%setup -q -D -T -b 5 +%setup -q -D -T -b 6 %endif %build @@ -396,13 +403,14 @@ export CFLAGS="$RPM_OPT_FLAGS -fpic" cd bld # Need ENABLE_FUZZ_TESTING=NO to avoid a link failure - # Modern approach for Python discovery in CMake + # Find python include dir and python library from + # https://stackoverflow.com/questions/24174394/cmake-is-not-able-to-find-python-libraries cmake .. \ -DBUILD_BINDINGS="" \ -DBUILD_STATIC_LIBS=YES \ -DENABLE_FUZZ_TESTING=NO \ - -DPython_FIND_STRATEGY=LOCATION \ - -DPython_ROOT_DIR=/usr \ + -DPYTHON_INCLUDE_DIR=$(python3 -c "from distutils.sysconfig import get_python_inc; print(get_python_inc())") \ + -DPYTHON_LIBRARY=$(python3 -c "import distutils.sysconfig as sysconfig; print(sysconfig.get_config_var('LIBDIR'))") \ -DCMAKE_AR="/usr/bin/gcc-ar" -DCMAKE_NM="/usr/bin/gcc-nm" -DCMAKE_RANLIB="/usr/bin/gcc-ranlib" make -j8 ) @@ -452,7 +460,7 @@ autoreconf -if --enable-omrabbitmq \ %endif %if %{with omamqp1} - --enable-omamqp1 PROTON_PROACTOR_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_PROACTOR_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ + --enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ %endif --enable-elasticsearch \ --enable-generate-man-pages \ @@ -513,9 +521,7 @@ autoreconf -if --enable-snmp \ %endif --enable-unlimited-select \ - --enable-usertools \ - --disable-libgcrypt \ - --enable-openssl_crypto_provider + --enable-usertools make V=1 @@ -533,10 +539,10 @@ install -d -m 700 %{buildroot}%{rsyslog_statedir} install -d -m 700 %{buildroot}%{rsyslog_pkidir} install -d -m 755 %{buildroot}%{rsyslog_docdir}/html -install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/rsyslog.conf -install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog -install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog -install -p -m 644 %{SOURCE4} %{buildroot}%{_unitdir}/rsyslog.service +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/rsyslog.conf +install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog +install -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog +install -p -m 644 %{SOURCE5} %{buildroot}%{_unitdir}/rsyslog.service %if %{with mysql} install -p -m 644 plugins/ommysql/createDB.sql %{buildroot}%{rsyslog_docdir}/mysql-createDB.sql @@ -575,8 +581,8 @@ done %{!?_licensedir:%global license %%doc} %license COPYING* %doc AUTHORS ChangeLog README.md +%{rsyslog_docdir} %exclude %{rsyslog_docdir}/html -%exclude %{rsyslog_docdir}/recover_qi.pl %if %{with mysql} %exclude %{rsyslog_docdir}/mysql-createDB.sql %endif @@ -616,7 +622,6 @@ done %{_libdir}/rsyslog/mmanon.so %{_libdir}/rsyslog/mmcount.so %{_libdir}/rsyslog/mmexternal.so -%{_libdir}/rsyslog/mmleefparse.so %{_libdir}/rsyslog/mmutf8fix.so %{_libdir}/rsyslog/omhttp.so %{_libdir}/rsyslog/omjournal.so @@ -642,11 +647,10 @@ done %files crypto %{_bindir}/rscryutil %{_mandir}/man1/rscryutil.1.gz -%{_libdir}/rsyslog/lmcry_ossl.so +%{_libdir}/rsyslog/lmcry_gcry.so %files doc -%{rsyslog_docdir}/html -%{rsyslog_docdir}/recover_qi.pl +%doc %{rsyslog_docdir}/html %files elasticsearch %{_libdir}/rsyslog/omelasticsearch.so @@ -755,46 +759,10 @@ done %changelog -* Mon Oct 20 2025 Attila Lakatos - 8.2510.0-1 -- Rebase to 8.2510.0 - Resolves: rhbz#2404131 -- imjournal open error handling fix - Resolves: rhbz#2375742 -- Add mmleefparse module to base package - -* Fri Sep 05 2025 Attila Lakatos - 8.2508.0-1 -- Rebase to 8.2508.0 - Resolves: rhbz#2392918 - -* Fri Jul 25 2025 Fedora Release Engineering - 8.2506.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Thu Jun 12 2025 Attila Lakatos - 8.2506.0-1 -- Rebase to 8.2506.0 - Resolves: rhbz#2347628 - -* Tue Jan 21 2025 Attila Lakatos - 8.2412.0-3 -- Fix build problem by resolving -Wincompatible-pointer-types error - -* Sat Jan 18 2025 Fedora Release Engineering - 8.2412.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Thu Dec 05 2024 Attila Lakatos - 8.2412.0-1 -- Rebase to 8.2412.0 -- Harden rsyslog service unit -- Disable openssl engines support - Resolves: rhbz#2320050 - -* Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 -- Rebuild package +* Fri Oct 04 2024 Attila Lakatos - 8.2312.0-5 +- Rebuild Resolves: rhbz#2316361 -* Wed Aug 21 2024 Attila Lakatos - 8.2408.0-1 -- Rebase to 8.2408.0 - Resolves: rhbz#2266329 - Resolves: rhbz#2301246 - Resolves: rhbz#2305398 - * Fri Jul 19 2024 Fedora Release Engineering - 8.2312.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 1294997..d55fac4 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -SHA512 (rsyslog-8.2510.0.tar.gz) = d2e693fd8c7112e4ccc36ea6fbb19909df885e7cb2778e95c04b7c5e9db8240224decfee52308a46865b7deffcf1e31ade0104c90d84b768a4dece15e5ea190e -SHA512 (qpid-proton-0.40.0.tar.gz) = 3e7fe56ca1423f45f71d81f5e1d6ec5f21c073cc580628e12a8dbd545a86805b7312834e0d1234dde43797633d575ed639f21a96239b217500cc0a824482aae3 +SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b +SHA512 (rsyslog-8.2312.0.tar.gz) = a65ca1c6fe2d9dd853d073d93cfd4d007c3533bd10c633113fcf94c4746192945ed0a2b2ff84f9174b55de90ade2a062a0bd556ffe375864fad3772ef8ce39e3 +SHA512 (rsyslog-doc-8.2312.0.tar.gz) = 2fe8ab0e37a6899a545c09ea2586c33ab89a3e3d93ff079f99b15e9b1743423bbe54931684ba8509ed4f578a4b55ea22f6306aca256ee2245f88115a5f44e400 diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb deleted file mode 100644 index 6661297..0000000 --- a/tests/got-audit/got-audit.gdb +++ /dev/null @@ -1,2 +0,0 @@ -gef config gef.disable_color True -got-audit --all diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf deleted file mode 100644 index a90b249..0000000 --- a/tests/got-audit/main.fmf +++ /dev/null @@ -1,10 +0,0 @@ -summary: Audit the GOT for signs of tampering -description: | - Pointers in the server process GOT will be checked to ensure that - each function pointer's value is within a shared object file - that exports a symbol of that name, and that no shared object - files export conflicting symbols. -contact: Gordon Messmer -require+: - - gdb-gef # needed to test got-audit - diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh deleted file mode 100755 index 03761a1..0000000 --- a/tests/got-audit/runtest.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/rsyslog/Sanity/got-audit -# Description: Check pointers in the server process GOT for signs of tampering -# Author: Gordon Messmer -# - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - rlPhaseStartSetup - rlServiceStart rsyslog - rlRun "TestDir=\$(pwd)" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" - rlPhaseEnd - - rlPhaseStartTest "Run GEF got-audit" - rlRun "SERVICE_PID=\$( systemctl show --property=MainPID rsyslog.service | cut -f2 -d= )" - rlRun "echo SERVICE_PID is '$SERVICE_PID'" - [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" - rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" - # Basic test: ensure that at least one symbol is found in libc.so, - # to verify that the report looks plausible. - rlAssertGrep " : /.*/libc.so" "$auditfile" - # Ensure the got-audit did not report any errors - rlAssertNotGrep " :: ERROR" "$auditfile" - rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" - rlPhaseEnd - - rlPhaseStartCleanup - rlServiceRestore rsyslog - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/tests/main.fmf b/tests/main.fmf deleted file mode 100644 index f225a72..0000000 --- a/tests/main.fmf +++ /dev/null @@ -1,2 +0,0 @@ -test: ./runtest.sh -framework: beakerlib