From 5f15cb8d9b938d9f86afbe1e5b97e8ef61a36e1c Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 9 Nov 2022 08:57:04 +0100 Subject: [PATCH 01/41] rebase to 8.2210.0 resolves: rhbz#2097173 Drop capabilities to the necessary set via libcap-ng resolves: rhbz#2127403 --- .gitignore | 2 + ...82302-CVE-heap-based-buffer-overflow.patch | 45 --- ...2210.0-rhbz2127403-drop-capabilities.patch | 258 ++++++++++++++++++ rsyslog.spec | 16 +- sources | 4 +- 5 files changed, 274 insertions(+), 51 deletions(-) delete mode 100644 rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch create mode 100644 rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch diff --git a/.gitignore b/.gitignore index c2bb745..54c1f3c 100644 --- a/.gitignore +++ b/.gitignore @@ -83,3 +83,5 @@ rsyslog-4.6.3.tar.gz /qpid-proton-0.34.0.tar.gz /rsyslog-8.2204.0.tar.gz /rsyslog-doc-8.2204.0.tar.gz +/rsyslog-8.2210.0.tar.gz +/rsyslog-doc-8.2210.0.tar.gz diff --git a/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch b/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch deleted file mode 100644 index cfdfc59..0000000 --- a/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch +++ /dev/null @@ -1,45 +0,0 @@ -diff --git a/contrib/imhttp/imhttp.c b/contrib/imhttp/imhttp.c -index f09260b586..95704af985 100644 ---- a/contrib/imhttp/imhttp.c -+++ b/contrib/imhttp/imhttp.c -@@ -487,7 +487,9 @@ processOctetMsgLen(const instanceConf_t *const inst, struct conn_wrkr_s *connWrk - connWrkr->parseState.iOctetsRemain = connWrkr->parseState.iOctetsRemain * 10 + ch - '0'; - } - // temporarily save this character into the message buffer -- connWrkr->pMsg[connWrkr->iMsg++] = ch; -+ if(connWrkr->iMsg + 1 < s_iMaxLine) { -+ connWrkr->pMsg[connWrkr->iMsg++] = ch; -+ } - } else { - const char *remoteAddr = ""; - if (connWrkr->propRemoteAddr) { -diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c -index 2df46a236c..c32dec5851 100644 ---- a/plugins/imptcp/imptcp.c -+++ b/plugins/imptcp/imptcp.c -@@ -1107,7 +1107,9 @@ processDataRcvd(ptcpsess_t *const __restrict__ pThis, - if(pThis->iOctetsRemain <= 200000000) { - pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0'; - } -- *(pThis->pMsg + pThis->iMsg++) = c; -+ if(pThis->iMsg < iMaxLine) { -+ *(pThis->pMsg + pThis->iMsg++) = c; -+ } - } else { /* done with the octet count, so this must be the SP terminator */ - DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain); - prop.GetString(pThis->peerName, &propPeerName, &lenPeerName); -diff --git a/runtime/tcps_sess.c b/runtime/tcps_sess.c -index 0efa2c23c4..c5442f7638 100644 ---- a/runtime/tcps_sess.c -+++ b/runtime/tcps_sess.c -@@ -390,7 +390,9 @@ processDataRcvd(tcps_sess_t *pThis, - if(pThis->iOctetsRemain <= 200000000) { - pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0'; - } -- *(pThis->pMsg + pThis->iMsg++) = c; -+ if(pThis->iMsg < iMaxLine) { -+ *(pThis->pMsg + pThis->iMsg++) = c; -+ } - } else { /* done with the octet count, so this must be the SP terminator */ - DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain); - prop.GetString(pThis->fromHost, &propPeerName, &lenPeerName); diff --git a/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch b/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch new file mode 100644 index 0000000..6b3f43f --- /dev/null +++ b/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch @@ -0,0 +1,258 @@ +From e9f85312630eb25d0985e911475803bd06f4173e Mon Sep 17 00:00:00 2001 +From: alakatos +Date: Thu, 13 Oct 2022 10:41:38 +0200 +Subject: [PATCH 1/2] Introduce --enable-libcap-ng configure option + +The option allows to drop the capabilities to only +the necessary set, to minimize security exposure in +case there was ever a mistake in a networking +plugin or some other input resource. Resolves #4986 +--- + configure.ac | 24 ++++++++++++++++++++++++ + runtime/debug.c | 4 ++-- + runtime/modules.c | 6 +++--- + runtime/rsyslog.h | 1 + + tools/rsyslogd.c | 42 ++++++++++++++++++++++++++++++++++++++++++ + 5 files changed, 72 insertions(+), 5 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 9f73a708d0..958c26245e 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -377,6 +377,28 @@ AC_ARG_ENABLE(fmhash, + [enable_fmhash=yes] + ) + ++AC_ARG_ENABLE(libcap-ng, ++ [AS_HELP_STRING([--enable-libcap-ng],[Enable dropping capabilities to only the necessary set @<:@default=no@:>@])], ++ [case "${enableval}" in ++ yes) enable_libcapng="yes" ;; ++ no) enable_libcapng="no" ;; ++ *) AC_MSG_ERROR(bad value ${enableval} for --enable_libcapng) ;; ++ esac], ++ [enable_libcapng=no] ++) ++ ++if test "$enable_libcapng" = "yes"; then ++ PKG_CHECK_MODULES( ++ [LIBCAPNG], ++ [libcap-ng >= 0.8.2], ++ [AC_DEFINE([ENABLE_LIBCAPNG], [1], [Indicator that libcap-ng is present])], ++ [AC_MSG_ERROR(libcap-ng is not present.)] ++ ) ++ CFLAGS="$CFLAGS $LIBCAPNG_CFLAGS" ++ LIBS="$LIBS $LIBCAPNG_LIBS" ++fi ++ ++ + AC_ARG_ENABLE(fmhash-xxhash, + [AS_HELP_STRING([--enable-fmhash-xxhash],[Enable xxhash in fmhash support @<:@default=no@:>@])], + [case "${enableval}" in +@@ -2820,6 +2842,8 @@ echo " liblogging-stdlog support enabled: $enable_liblogging_stdlog" + echo " libsystemd enabled: $enable_libsystemd" + echo " kafka static linking enabled: $enable_kafka_static" + echo " atomic operations enabled: $enable_atomic_operations" ++echo " libcap-ng support enabled: $enable_libcapng" ++ + echo + echo "---{ input plugins }---" + if test "$unamestr" != "AIX"; then +diff --git a/runtime/debug.c b/runtime/debug.c +index a655bc2e4e..6e6c9fd38f 100644 +--- a/runtime/debug.c ++++ b/runtime/debug.c +@@ -250,7 +250,7 @@ r_dbgoprint( const char *srcname, obj_t *pObj, const char *fmt, ...) + + if(!(Debug && debugging_on)) + return; +- ++ + if(!checkDbgFile(srcname)) { + return; + } +@@ -435,7 +435,7 @@ rsRetVal dbgClassInit(void) + { + rsRetVal iRet; /* do not use DEFiRet, as this makes calls into the debug system! */ + +- ++ + (void) pthread_key_create(&keyThrdName, dbgThrdNameDestruct); + + /* while we try not to use any of the real rsyslog code (to avoid infinite loops), we +diff --git a/runtime/modules.c b/runtime/modules.c +index 810b2e9b52..b39bd9f066 100644 +--- a/runtime/modules.c ++++ b/runtime/modules.c +@@ -595,7 +595,7 @@ doModInit(pModInit_t modInit, uchar *name, void *pModHdlr, modInfo_t **pNewModul + CHKiRet((*pNew->modQueryEtryPt)((uchar*)"getKeepType", &modGetKeepType)); + CHKiRet((*modGetKeepType)(&pNew->eKeepType)); + dbgprintf("module %s of type %d being loaded (keepType=%d).\n", name, pNew->eType, pNew->eKeepType); +- ++ + /* OK, we know we can successfully work with the module. So we now fill the + * rest of the data elements. First we load the interfaces common to all + * module types. +@@ -1242,7 +1242,7 @@ Load(uchar *const pModName, const sbool bConfLoad, struct nvlst *const lst) + } + + iLoadCnt++; +- ++ + } while(pModHdlr == NULL && *pModName != '/' && pModDirNext); + + if(load_err_msg != NULL) { +@@ -1323,7 +1323,7 @@ modulesProcessCnf(struct cnfobj *o) + + cnfModName = (uchar*)es_str2cstr(pvals[typeIdx].val.d.estr, NULL); + iRet = Load(cnfModName, 1, o->nvlst); +- ++ + finalize_it: + free(cnfModName); + cnfparamvalsDestruct(pvals, &pblk); +diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h +index 908e5e7b73..01616d8f7d 100644 +--- a/runtime/rsyslog.h ++++ b/runtime/rsyslog.h +@@ -604,6 +604,7 @@ enum rsRetVal_ /** return value. All methods return this if not specified oth + RS_RET_REDIS_ERROR = -2452, /**< redis-specific error. See message foe details. */ + RS_RET_REDIS_AUTH_FAILED = -2453, /**< redis authentication failure */ + RS_RET_FAUP_INIT_OPTIONS_FAILED = -2454, /**< could not initialize faup options */ ++ RS_RET_LIBCAPNG_ERR = -2455, /**< error during dropping the capabilities */ + + /* RainerScript error messages (range 1000.. 1999) */ + RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */ +diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c +index 31b91a1bd1..c209e1bcdd 100644 +--- a/tools/rsyslogd.c ++++ b/tools/rsyslogd.c +@@ -37,6 +37,9 @@ + #ifdef HAVE_LIBSYSTEMD + # include + #endif ++#ifdef ENABLE_LIBCAPNG ++ #include ++#endif + + #include "rsyslog.h" + #include "wti.h" +@@ -2167,6 +2170,45 @@ main(int argc, char **argv) + fjson_global_do_case_sensitive_comparison(0); + + dbgClassInit(); ++ ++#ifdef ENABLE_LIBCAPNG ++ /* ++ * Drop capabilities to the necessary set ++ */ ++ int capng_rc; ++ capng_clear(CAPNG_SELECT_BOTH); ++ ++ if ((capng_rc = capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, ++ CAP_BLOCK_SUSPEND, ++ CAP_CHOWN, ++ CAP_IPC_LOCK, ++ CAP_LEASE, ++ CAP_NET_ADMIN, ++ CAP_NET_BIND_SERVICE, ++ CAP_PERFMON, ++ CAP_SETGID, ++ CAP_SETUID, ++ CAP_SYS_ADMIN, ++ CAP_SYS_CHROOT, ++ CAP_SYS_RESOURCE, ++ CAP_SYSLOG, ++ -1 ++ )) != 0) { ++ LogError(0, RS_RET_LIBCAPNG_ERR, ++ "could not update the internal posix capabilities settings " ++ "based on the options passed to it, capng_updatev=%d\n", capng_rc); ++ exit(-1); ++ } ++ ++ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { ++ LogError(0, RS_RET_LIBCAPNG_ERR, ++ "could not transfer the specified internal posix capabilities " ++ "settings to the kernel, capng_apply=%d\n", capng_rc); ++ exit(-1); ++ } ++ DBGPRINTF("Capabilities were dropped successfully\n"); ++#endif ++ + initAll(argc, argv); + #ifdef HAVE_LIBSYSTEMD + sd_notify(0, "READY=1"); + +From 305e07a2b757b98dc7e26c148c175901034451b9 Mon Sep 17 00:00:00 2001 +From: alakatos +Date: Mon, 31 Oct 2022 12:30:48 +0100 +Subject: [PATCH 2/2] Add ability to change uid and gid while retaining the + capabilities previously specified + +--- + runtime/rsconf.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/runtime/rsconf.c b/runtime/rsconf.c +index 4620ff8d13..24d1ec3570 100644 +--- a/runtime/rsconf.c ++++ b/runtime/rsconf.c +@@ -34,6 +34,10 @@ + #include + #include + #include ++#ifdef ENABLE_LIBCAPNG ++ #include ++#endif ++ + + #include "rsyslog.h" + #include "obj.h" +@@ -656,6 +660,7 @@ rsRetVal doDropPrivGid(rsconf_t *cnf) + uchar szBuf[1024]; + DEFiRet; + ++#ifndef ENABLE_LIBCAPNG + if(!cnf->globals.gidDropPrivKeepSupplemental) { + res = setgroups(0, NULL); /* remove all supplemental group IDs */ + if(res) { +@@ -668,9 +673,19 @@ rsRetVal doDropPrivGid(rsconf_t *cnf) + res = setgid(cnf->globals.gidDropPriv); + if(res) { + LogError(errno, RS_RET_ERR_DROP_PRIV, +- "could not set requested group id %d", cnf->globals.gidDropPriv); ++ "could not set requested group id %d via setgid()", cnf->globals.gidDropPriv); + ABORT_FINALIZE(RS_RET_ERR_DROP_PRIV); + } ++#else ++ int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP; ++ res = capng_change_id(-1, cnf->globals.gidDropPriv, capng_flags); ++ if (res) { ++ LogError(0, RS_RET_LIBCAPNG_ERR, ++ "could not set requested group id %d via capng_change_id()", cnf->globals.gidDropPriv); ++ ABORT_FINALIZE(RS_RET_LIBCAPNG_ERR); ++ } ++#endif ++ + DBGPRINTF("setgid(%d): %d\n", cnf->globals.gidDropPriv, res); + snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's groupid changed to %d", + cnf->globals.gidDropPriv); +@@ -705,12 +720,18 @@ static void doDropPrivUid(rsconf_t *cnf) + cnf->globals.uidDropPriv); + } + ++#ifndef ENABLE_LIBCAPNG + res = setuid(cnf->globals.uidDropPriv); ++#else ++ int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP; ++ res = capng_change_id(cnf->globals.uidDropPriv, -1, capng_flags); ++#endif + if(res) { + /* if we can not set the userid, this is fatal, so let's unconditionally abort */ + perror("could not set requested userid"); + exit(1); + } ++ + DBGPRINTF("setuid(%d): %d\n", cnf->globals.uidDropPriv, res); + snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's userid changed to %d", cnf->globals.uidDropPriv); + logmsgInternal(NO_ERRCODE, LOG_SYSLOG|LOG_INFO, szBuf, 0); diff --git a/rsyslog.spec b/rsyslog.spec index 54efe70..5063094 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -7,8 +7,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2204.0 -Release: 3%{?dist} +Version: 8.2210.0 +Release: 1%{?dist} License: (GPLv3+ and ASL 2.0) URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -22,7 +22,7 @@ Source5: rsyslog.service Source6: qpid-proton-0.34.0.tar.gz Patch0: openssl3-compatibility.patch -Patch1: rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch +Patch1: rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch BuildRequires: make BuildRequires: gcc @@ -42,6 +42,7 @@ BuildRequires: python3-docutils BuildRequires: systemd-devel >= 204-8 BuildRequires: zlib-devel BuildRequires: openssl-devel +BuildRequires: libcap-ng-devel Requires: openssl-libs Recommends: %{name}-logrotate = %version-%release @@ -300,7 +301,7 @@ pushd .. %patch0 -p1 -b .openssl-compatibility popd -%patch1 -p1 -b .CVE-buffer-overflow +%patch1 -p1 -b .libcap-ng %build %ifarch sparc64 @@ -350,6 +351,7 @@ autoreconf -if --enable-clickhouse \ --enable-imdocker \ --enable-improg \ + --enable-libcap-ng \ --enable-libdbi \ --enable-omamqp1 \ --enable-omhiredis \ @@ -586,6 +588,12 @@ done %changelog +* Wed Nov 09 2022 Attila Lakatos - 8.2210.0-1 +- rebase to 8.2210.0 + resolves: rhbz#2097173 +- Drop capabilities to the necessary set via libcap-ng + resolves: rhbz#2127403 + * Wed Jul 27 2022 Attila Lakatos - 8.2204.0-3 - Restore default omfile template resolves: rhbz#2088618 diff --git a/sources b/sources index 660b19b..4004c45 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (rsyslog-8.2204.0.tar.gz) = d26ab950788b8931b895719f7d8a42509f709b69a76e4188df16f72be050863ee402310ad9300840fed4ac089638497725d67433172778be7b2932fa82210472 -SHA512 (rsyslog-doc-8.2204.0.tar.gz) = 361528b95c1f02cdc2b2ca8ba5252c8215996e81ef1602e08c46be4e1fd8c1c287dd7d52ae9b2b58c0ec7fe38d7079a89e10642ac3f34fe0b6c5737968999fb4 SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3 +SHA512 (rsyslog-8.2210.0.tar.gz) = c665b7f7a3c5ef31c9b62b50f815cfbb52db0cbe4a06934f4f1c3cd2a56fb49c319d33857ee92ab843aa5894cac16c16b8eccdf83714f31ab57a95049c4af231 +SHA512 (rsyslog-doc-8.2210.0.tar.gz) = e7847a9307a91fdf87d6cf91d2391eb75869679905b9598310c456fb3fe1864fc06dbdc649778f5b3788e47ffda0a6d89cb894258e55db441f7df7e74b0ae9f4 From c61f1049a42724b20984dc257b464057e6cf2c7b Mon Sep 17 00:00:00 2001 From: alakatos Date: Fri, 16 Dec 2022 12:43:29 +0100 Subject: [PATCH 02/41] Move all if rhel feature conditions to bcond Move to bcond: rdkafka, relp, mysql, pgsql, gssapi, gnutls, udpspoof, omamqp1 Move to bcond: clickhouse, imdocker, improg The idea was initiated by trawets at PR32 --- rsyslog.spec | 198 +++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 186 insertions(+), 12 deletions(-) diff --git a/rsyslog.spec b/rsyslog.spec index 5063094..fe58095 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -4,11 +4,38 @@ # The following packages are not enabled on rhel: # hiredis, libdbi, mongodb, rabbitmq # The omamqp1 plugin is built differently as qpid-proton is not available on rhel +%if 0%{?rhel} +%bcond_with hiredis +%bcond_with libdbi +%bcond_with mongodb +%bcond_with rabbitmq +%else +%bcond_without hiredis +%bcond_without libdbi +%bcond_without mongodb +%bcond_without rabbitmq +%endif + +# Add options to not build with features listed below, +# the default is to build with them. +%bcond_without clickhouse +%bcond_without imdocker +%bcond_without improg +%bcond_without gnutls +%bcond_without openssl +%bcond_without gssapi +%bcond_without omamqp1 +%bcond_without rdkafka +%bcond_without relp +%bcond_without mysql +%bcond_without pgsql +%bcond_without snmp +%bcond_without udpspoof Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2210.0 -Release: 1%{?dist} +Release: 2%{?dist} License: (GPLv3+ and ASL 2.0) URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -40,11 +67,10 @@ BuildRequires: pkgconfig BuildRequires: python3-docutils # make sure systemd is in a version that isn't affected by rhbz#974132 BuildRequires: systemd-devel >= 204-8 +BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel -BuildRequires: openssl-devel BuildRequires: libcap-ng-devel -Requires: openssl-libs Recommends: %{name}-logrotate = %version-%release Requires: bash >= 2.0 %{?systemd_ordering} @@ -87,51 +113,71 @@ Requires: %name = %version-%release Summary: Fields extraction module Requires: %name = %version-%release +%if %{with snmp} %package mmsnmptrapd Summary: Message modification module for snmptrapd generated messages Requires: %name = %version-%release +%endif +%if %{with mysql} %package mysql Summary: MySQL support for rsyslog Requires: %name = %version-%release BuildRequires: mariadb-connector-c-devel +%endif +%if %{with pgsql} %package pgsql Summary: PostgresSQL support for rsyslog Requires: %name = %version-%release BuildRequires: libpq-devel +%endif +%if %{with gssapi} %package gssapi Summary: GSSAPI authentication and encryption support for rsyslog Requires: %name = %version-%release BuildRequires: krb5-devel +%endif +%if %{with relp} %package relp Summary: RELP protocol support for rsyslog Requires: %name = %version-%release BuildRequires: librelp-devel >= 1.2.16 +%endif +%if %{with gnutls} %package gnutls Summary: TLS protocol support for rsyslog via GnuTLS library Requires: %name = %version-%release BuildRequires: gnutls-devel +%endif +%if %{with openssl} %package openssl Summary: TLS protocol support for rsyslog via OpenSSL library Group: System Environment/Daemons Requires: %name = %version-%release +Requires: openssl-libs BuildRequires: openssl-devel +%endif +%if %{with snmp} %package snmp Summary: SNMP protocol support for rsyslog Requires: %name = %version-%release BuildRequires: net-snmp-devel +%endif +%if %{with udpspoof} %package udpspoof Summary: Provides the omudpspoof module Requires: %name = %version-%release BuildRequires: libnet-devel +%endif +%if %{with omamqp1} %package omamqp1 Summary: Provides the omamqp1 module Requires: %name = %version-%release @@ -144,33 +190,42 @@ BuildRequires: gcc-c++ BuildRequires: cyrus-sasl-devel BuildRequires: openssl-devel BuildRequires: python3 +%endif +%if %{with rdkafka} %package kafka Summary: Provides the omkafka module Requires: %name = %version-%release BuildRequires: librdkafka-devel +%endif %package mmkubernetes Summary: Provides the mmkubernetes module Requires: %name = %version-%release BuildRequires: libcurl-devel -%if 0%{?rhel} == 0 +%if %{with hiredis} %package hiredis Summary: Redis support for rsyslog Requires: %name = %version-%release BuildRequires: hiredis-devel +%endif +%if %{with libdbi} %package libdbi Summary: Libdbi database support for rsyslog Requires: %name = %version-%release BuildRequires: libdbi-devel +%endif +%if %{with mongodb} %package mongodb Summary: MongoDB support for rsyslog Requires: %name = %version-%release BuildRequires: mongo-c-driver-devel snappy-devel cyrus-sasl-devel +%endif +%if %{with rabbitmq} %package rabbitmq Summary: RabbitMQ support for rsyslog Requires: %name = %version-%release @@ -217,73 +272,101 @@ advantage if a field-based log format is to be processed, like for example CEF and either a large number of fields is needed or a specific field is used multiple times inside filters. +%if %{with snmp} %description mmsnmptrapd This message modification module takes messages generated from snmptrapd and modifies them so that they look like they originated from the read originator. +%endif +%if %{with mysql} %description mysql The rsyslog-mysql package contains a dynamic shared object that will add MySQL database support to rsyslog. +%endif +%if %{with pgsql} %description pgsql The rsyslog-pgsql package contains a dynamic shared object that will add PostgreSQL database support to rsyslog. +%endif +%if %{with gssapi} %description gssapi The rsyslog-gssapi package contains the rsyslog plugins which support GSSAPI authentication and secure connections. GSSAPI is commonly used for Kerberos authentication. +%endif +%if %{with relp} %description relp The rsyslog-relp package contains the rsyslog plugins that provide the ability to receive syslog messages via the reliable RELP protocol. +%endif +%if %{with gnutls} %description gnutls The rsyslog-gnutls package contains the rsyslog plugins that provide the ability to send and receive syslog messages via TCP or RELP using TLS encryption via GnuTLS library. For details refer to rsyslog doc on imtcp and omfwd modules. +%endif +%if %{with openssl} %description openssl The rsyslog-openssl package contains the rsyslog plugins that provide the ability to send and receive syslog messages via TCP or RELP using TLS encryption via OpenSSL library. For details refer to rsyslog doc on imtcp and omfwd modules. +%endif +%if %{with snmp} %description snmp The rsyslog-snmp package contains the rsyslog plugin that provides the ability to send syslog messages as SNMPv1 and SNMPv2c traps. +%endif +%if %{with udpspoof} %description udpspoof This module is similar to the regular UDP forwarder, but permits to spoof the sender address. Also, it enables to circle through a number of source ports. +%endif +%if %{with omamqp1} %description omamqp1 The omamqp1 output module can be used to send log messages via an AMQP 1.0-compatible messaging bus. +%endif +%if %{with rdkafka} %description kafka The rsyslog-kafka package provides module for Apache Kafka output. +%endif %description mmkubernetes The rsyslog-mmkubernetes package provides module for adding kubernetes container metadata. -%if 0%{?rhel} == 0 +%if %{with hiredis} %description hiredis This module provides output to Redis. +%endif +%if %{with libdbi} %description libdbi This module supports a large number of database systems via libdbi. Libdbi abstracts the database layer and provides drivers for many systems. Drivers are available via the libdbi-drivers project. +%endif +%if %{with mongodb} %description mongodb The rsyslog-mongodb package contains a dynamic shared object that will add MongoDB database support to rsyslog. +%endif +%if %{with rabbitmq} %description rabbitmq This module allows rsyslog to send messages to a RabbitMQ server. %endif @@ -295,11 +378,14 @@ rm -r LICENSE README.md source build/objects.inv mv build doc # set up rsyslog sources %setup -q -D + +%if %{with omamqp1} # Unpack qpid-proton %setup -q -D -T -b 6 pushd .. %patch0 -p1 -b .openssl-compatibility popd +%endif %patch1 -p1 -b .libcap-ng @@ -310,6 +396,8 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIC" %else export CFLAGS="$RPM_OPT_FLAGS -fpic" %endif + +%if %{with omamqp1} # build the proton first ( cd %{_builddir}/qpid-proton-0.34.0 @@ -328,6 +416,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fpic" -DCMAKE_AR="/usr/bin/gcc-ar" -DCMAKE_NM="/usr/bin/gcc-nm" -DCMAKE_RANLIB="/usr/bin/gcc-ranlib" make -j8 ) +%endif %ifarch sparc64 #sparc64 need big PIE @@ -337,35 +426,61 @@ export CFLAGS="$RPM_OPT_FLAGS -fpie" %endif export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" +%if %{with hiredis} # the hiredis-devel package doesn't provide a pkg-config file -%if 0%{?rhel} == 0 export HIREDIS_CFLAGS=-I/usr/include/hiredis export HIREDIS_LIBS="-L%{_libdir} -lhiredis" %endif + sed -i 's/%{version}/%{version}-%{release}/g' configure.ac + autoreconf -if %configure \ --prefix=/usr \ --disable-static \ --disable-testbench \ +%if %{with clickhouse} --enable-clickhouse \ +%endif +%if %{with imdocker} --enable-imdocker \ +%endif +%if %{with improg} --enable-improg \ - --enable-libcap-ng \ +%endif + --enable-libcap-ng \ +%if %{with libdbi} --enable-libdbi \ - --enable-omamqp1 \ +%endif +%if %{with hiredis} --enable-omhiredis \ +%endif +%if %{with mongodb} --enable-ommongodb \ +%endif +%if %{with rabbitmq} --enable-omrabbitmq \ +%endif +%if %{with omamqp1} --enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-0.34.0/bld/c/include" \ +%endif --enable-elasticsearch \ --enable-generate-man-pages \ +%if %{with gnutls} --enable-gnutls \ +%endif +%if %{with openssl} --enable-openssl \ +%endif +%if %{with gssapi} --enable-gssapi-krb5 \ +%endif --enable-imfile \ --enable-imjournal \ +%if %{with rdkafka} --enable-imkafka \ + --enable-omkafka \ +%endif --enable-impstats \ --enable-imptcp \ --enable-mail \ @@ -376,25 +491,36 @@ autoreconf -if --enable-mmkubernetes \ --enable-mmjsonparse \ --enable-mmnormalize \ +%if %{with snmp} --enable-mmsnmptrapd \ +%endif --enable-mmutf8fix \ +%if %{with mysql} --enable-mysql \ +%endif --enable-omhttp \ --enable-omjournal \ --enable-omprog \ --enable-omstdout \ +%if %{with udpspoof} --enable-omudpspoof \ +%endif --enable-omuxsock \ +%if %{with pgsql} --enable-pgsql \ +%endif --enable-pmaixforwardedfrom \ --enable-pmcisconames \ --enable-pmlastmsg \ --enable-pmsnare \ +%if %{with relp} --enable-relp \ +%endif +%if %{with snmp} --enable-snmp \ +%endif --enable-unlimited-select \ - --enable-usertools \ - --enable-omkafka + --enable-usertools make V=1 @@ -416,8 +542,15 @@ install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/rsyslog.conf install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog install -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog install -p -m 644 %{SOURCE5} %{buildroot}%{_unitdir}/rsyslog.service + +%if %{with mysql} install -p -m 644 plugins/ommysql/createDB.sql %{buildroot}%{rsyslog_docdir}/mysql-createDB.sql +%endif + +%if %{with pgsql} install -p -m 644 plugins/ompgsql/createDB.sql %{buildroot}%{rsyslog_docdir}/pgsql-createDB.sql +%endif + dos2unix tools/recover_qi.pl install -p -m 644 tools/recover_qi.pl %{buildroot}%{rsyslog_docdir}/recover_qi.pl install -p -m 644 contrib/mmkubernetes/*.rulebase %{buildroot}%{rsyslog_docdir} @@ -449,8 +582,12 @@ done %doc AUTHORS ChangeLog README.md %{rsyslog_docdir} %exclude %{rsyslog_docdir}/html +%if %{with mysql} %exclude %{rsyslog_docdir}/mysql-createDB.sql +%endif +%if %{with pgsql} %exclude %{rsyslog_docdir}/pgsql-createDB.sql +%endif %dir %{_libdir}/rsyslog %dir %{_sysconfdir}/rsyslog.d %dir %{rsyslog_statedir} @@ -495,9 +632,13 @@ done %{_libdir}/rsyslog/pmcisconames.so %{_libdir}/rsyslog/pmlastmsg.so %{_libdir}/rsyslog/pmsnare.so -%if 0%{?rhel} == 0 +%if %{with imdocker} %{_libdir}/rsyslog/imdocker.so +%endif +%if %{with improg} %{_libdir}/rsyslog/improg.so +%endif +%if %{with clickhouse} %{_libdir}/rsyslog/omclickhouse.so %endif @@ -527,67 +668,100 @@ done %files mmnormalize %{_libdir}/rsyslog/mmnormalize.so +%if %{with snmp} %files mmsnmptrapd %{_libdir}/rsyslog/mmsnmptrapd.so +%endif +%if %{with mysql} %files mysql %doc %{rsyslog_docdir}/mysql-createDB.sql %{_libdir}/rsyslog/ommysql.so +%endif +%if %{with pgsql} %files pgsql %doc %{rsyslog_docdir}/pgsql-createDB.sql %{_libdir}/rsyslog/ompgsql.so +%endif +%if %{with gssapi} %files gssapi %{_libdir}/rsyslog/lmgssutil.so %{_libdir}/rsyslog/imgssapi.so %{_libdir}/rsyslog/omgssapi.so +%endif +%if %{with relp} %files relp %{_libdir}/rsyslog/imrelp.so %{_libdir}/rsyslog/omrelp.so +%endif +%if %{with gnutls} %files gnutls %{_libdir}/rsyslog/lmnsd_gtls.so +%endif +%if %{with openssl} %files openssl %{_libdir}/rsyslog/lmnsd_ossl.so +%endif +%if %{with snmp} %files snmp %{_libdir}/rsyslog/omsnmp.so +%endif +%if %{with udpspoof} %files udpspoof %{_libdir}/rsyslog/omudpspoof.so +%endif +%if %{with omamqp1} %files omamqp1 %{_libdir}/rsyslog/omamqp1.so +%endif +%if %{with rdkafka} %files kafka %{_libdir}/rsyslog/imkafka.so %{_libdir}/rsyslog/omkafka.so +%endif %files mmkubernetes %{_libdir}/rsyslog/mmkubernetes.so %doc %{rsyslog_docdir}/k8s_filename.rulebase %doc %{rsyslog_docdir}/k8s_container_name.rulebase -%if 0%{?rhel} == 0 +%if %{with hiredis} %files hiredis %{_libdir}/rsyslog/omhiredis.so +%endif +%if %{with libdbi} %files libdbi %{_libdir}/rsyslog/omlibdbi.so +%endif +%if %{with mongodb} %files mongodb %{_bindir}/logctl %{_libdir}/rsyslog/ommongodb.so +%endif +%if %{with rabbitmq} %files rabbitmq %{_libdir}/rsyslog/omrabbitmq.so %endif %changelog +* Fri Dec 16 2022 Attila Lakatos - 8.2210.0-2 +- Move all if rhel feature conditions to bcond +- Move to bcond: rdkafka, relp, mysql, pgsql, gssapi, gnutls, udpspoof, omamqp1 +- Move to bcond: clickhouse, imdocker, improg + * Wed Nov 09 2022 Attila Lakatos - 8.2210.0-1 - rebase to 8.2210.0 resolves: rhbz#2097173 From 8b6dfc76536de1794469f66d5f830692a040fdaf Mon Sep 17 00:00:00 2001 From: alakatos Date: Tue, 17 Jan 2023 17:01:37 +0100 Subject: [PATCH 03/41] Adjust capability set for libcap-ng --- ...2210.0-rhbz2127403-drop-capabilities.patch | 205 +++++++++--------- rsyslog.spec | 6 +- 2 files changed, 109 insertions(+), 102 deletions(-) diff --git a/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch b/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch index 6b3f43f..cb583fb 100644 --- a/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch +++ b/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch @@ -1,20 +1,3 @@ -From e9f85312630eb25d0985e911475803bd06f4173e Mon Sep 17 00:00:00 2001 -From: alakatos -Date: Thu, 13 Oct 2022 10:41:38 +0200 -Subject: [PATCH 1/2] Introduce --enable-libcap-ng configure option - -The option allows to drop the capabilities to only -the necessary set, to minimize security exposure in -case there was ever a mistake in a networking -plugin or some other input resource. Resolves #4986 ---- - configure.ac | 24 ++++++++++++++++++++++++ - runtime/debug.c | 4 ++-- - runtime/modules.c | 6 +++--- - runtime/rsyslog.h | 1 + - tools/rsyslogd.c | 42 ++++++++++++++++++++++++++++++++++++++++++ - 5 files changed, 72 insertions(+), 5 deletions(-) - diff --git a/configure.ac b/configure.ac index 9f73a708d0..958c26245e 100644 --- a/configure.ac @@ -110,91 +93,8 @@ index 810b2e9b52..b39bd9f066 100644 finalize_it: free(cnfModName); cnfparamvalsDestruct(pvals, &pblk); -diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h -index 908e5e7b73..01616d8f7d 100644 ---- a/runtime/rsyslog.h -+++ b/runtime/rsyslog.h -@@ -604,6 +604,7 @@ enum rsRetVal_ /** return value. All methods return this if not specified oth - RS_RET_REDIS_ERROR = -2452, /**< redis-specific error. See message foe details. */ - RS_RET_REDIS_AUTH_FAILED = -2453, /**< redis authentication failure */ - RS_RET_FAUP_INIT_OPTIONS_FAILED = -2454, /**< could not initialize faup options */ -+ RS_RET_LIBCAPNG_ERR = -2455, /**< error during dropping the capabilities */ - - /* RainerScript error messages (range 1000.. 1999) */ - RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */ -diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c -index 31b91a1bd1..c209e1bcdd 100644 ---- a/tools/rsyslogd.c -+++ b/tools/rsyslogd.c -@@ -37,6 +37,9 @@ - #ifdef HAVE_LIBSYSTEMD - # include - #endif -+#ifdef ENABLE_LIBCAPNG -+ #include -+#endif - - #include "rsyslog.h" - #include "wti.h" -@@ -2167,6 +2170,45 @@ main(int argc, char **argv) - fjson_global_do_case_sensitive_comparison(0); - - dbgClassInit(); -+ -+#ifdef ENABLE_LIBCAPNG -+ /* -+ * Drop capabilities to the necessary set -+ */ -+ int capng_rc; -+ capng_clear(CAPNG_SELECT_BOTH); -+ -+ if ((capng_rc = capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, -+ CAP_BLOCK_SUSPEND, -+ CAP_CHOWN, -+ CAP_IPC_LOCK, -+ CAP_LEASE, -+ CAP_NET_ADMIN, -+ CAP_NET_BIND_SERVICE, -+ CAP_PERFMON, -+ CAP_SETGID, -+ CAP_SETUID, -+ CAP_SYS_ADMIN, -+ CAP_SYS_CHROOT, -+ CAP_SYS_RESOURCE, -+ CAP_SYSLOG, -+ -1 -+ )) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not update the internal posix capabilities settings " -+ "based on the options passed to it, capng_updatev=%d\n", capng_rc); -+ exit(-1); -+ } -+ -+ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not transfer the specified internal posix capabilities " -+ "settings to the kernel, capng_apply=%d\n", capng_rc); -+ exit(-1); -+ } -+ DBGPRINTF("Capabilities were dropped successfully\n"); -+#endif -+ - initAll(argc, argv); - #ifdef HAVE_LIBSYSTEMD - sd_notify(0, "READY=1"); - -From 305e07a2b757b98dc7e26c148c175901034451b9 Mon Sep 17 00:00:00 2001 -From: alakatos -Date: Mon, 31 Oct 2022 12:30:48 +0100 -Subject: [PATCH 2/2] Add ability to change uid and gid while retaining the - capabilities previously specified - ---- - runtime/rsconf.c | 23 ++++++++++++++++++++++- - 1 file changed, 22 insertions(+), 1 deletion(-) - diff --git a/runtime/rsconf.c b/runtime/rsconf.c -index 4620ff8d13..24d1ec3570 100644 +index 4620ff8d13..de2a21b406 100644 --- a/runtime/rsconf.c +++ b/runtime/rsconf.c @@ -34,6 +34,10 @@ @@ -256,3 +156,106 @@ index 4620ff8d13..24d1ec3570 100644 DBGPRINTF("setuid(%d): %d\n", cnf->globals.uidDropPriv, res); snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's userid changed to %d", cnf->globals.uidDropPriv); logmsgInternal(NO_ERRCODE, LOG_SYSLOG|LOG_INFO, szBuf, 0); +@@ -739,6 +760,29 @@ dropPrivileges(rsconf_t *cnf) + cnf->globals.uidDropPriv); + } + ++#ifdef ENABLE_LIBCAPNG ++ /* In case privileges were dropped, do not allow bypassing ++ * file read, write, and execute permission checks ++ */ ++ if (cnf->globals.gidDropPriv != 0 || cnf->globals.uidDropPriv != 0) { ++ int capng_rc; ++ if ((capng_rc = capng_update(CAPNG_DROP, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_DAC_OVERRIDE)) != 0) { ++ LogError(0, RS_RET_LIBCAPNG_ERR, ++ "could not update the internal posix capabilities settings " ++ "based on the options passed to it, capng_update=%d\n", capng_rc); ++ exit(-1); ++ } ++ ++ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { ++ LogError(0, RS_RET_LIBCAPNG_ERR, ++ "could not transfer the specified internal posix capabilities " ++ "settings to the kernel, capng_apply=%d\n", capng_rc); ++ exit(-1); ++ } ++ } ++ ++#endif ++ + finalize_it: + RETiRet; + } +diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h +index 908e5e7b73..01616d8f7d 100644 +--- a/runtime/rsyslog.h ++++ b/runtime/rsyslog.h +@@ -604,6 +604,7 @@ enum rsRetVal_ /** return value. All methods return this if not specified oth + RS_RET_REDIS_ERROR = -2452, /**< redis-specific error. See message foe details. */ + RS_RET_REDIS_AUTH_FAILED = -2453, /**< redis authentication failure */ + RS_RET_FAUP_INIT_OPTIONS_FAILED = -2454, /**< could not initialize faup options */ ++ RS_RET_LIBCAPNG_ERR = -2455, /**< error during dropping the capabilities */ + + /* RainerScript error messages (range 1000.. 1999) */ + RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */ +diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c +index 31b91a1bd1..77d814b482 100644 +--- a/tools/rsyslogd.c ++++ b/tools/rsyslogd.c +@@ -37,6 +37,9 @@ + #ifdef HAVE_LIBSYSTEMD + # include + #endif ++#ifdef ENABLE_LIBCAPNG ++ #include ++#endif + + #include "rsyslog.h" + #include "wti.h" +@@ -2167,6 +2170,46 @@ main(int argc, char **argv) + fjson_global_do_case_sensitive_comparison(0); + + dbgClassInit(); ++ ++#ifdef ENABLE_LIBCAPNG ++ /* ++ * Drop capabilities to the necessary set ++ */ ++ int capng_rc; ++ capng_clear(CAPNG_SELECT_BOTH); ++ ++ if ((capng_rc = capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, ++ CAP_BLOCK_SUSPEND, ++ CAP_CHOWN, ++ CAP_IPC_LOCK, ++ CAP_LEASE, ++ CAP_NET_ADMIN, ++ CAP_NET_BIND_SERVICE, ++ CAP_DAC_OVERRIDE, ++ CAP_SETGID, ++ CAP_SETUID, ++ CAP_SETPCAP, ++ CAP_SYS_ADMIN, ++ CAP_SYS_CHROOT, ++ CAP_SYS_RESOURCE, ++ CAP_SYSLOG, ++ -1 ++ )) != 0) { ++ LogError(0, RS_RET_LIBCAPNG_ERR, ++ "could not update the internal posix capabilities settings " ++ "based on the options passed to it, capng_updatev=%d\n", capng_rc); ++ exit(-1); ++ } ++ ++ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { ++ LogError(0, RS_RET_LIBCAPNG_ERR, ++ "could not transfer the specified internal posix capabilities " ++ "settings to the kernel, capng_apply=%d\n", capng_rc); ++ exit(-1); ++ } ++ DBGPRINTF("Capabilities were dropped successfully\n"); ++#endif ++ + initAll(argc, argv); + #ifdef HAVE_LIBSYSTEMD + sd_notify(0, "READY=1"); diff --git a/rsyslog.spec b/rsyslog.spec index fe58095..867e492 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -35,7 +35,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2210.0 -Release: 2%{?dist} +Release: 3%{?dist} License: (GPLv3+ and ASL 2.0) URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -757,6 +757,10 @@ done %changelog +* Tue Jan 17 2023 Attila Lakatos - 8.2210.0-3 +- Remove CAP_PERFMON from the capability set +- Add CAP_DAC_OVERRIDE to the capability set + * Fri Dec 16 2022 Attila Lakatos - 8.2210.0-2 - Move all if rhel feature conditions to bcond - Move to bcond: rdkafka, relp, mysql, pgsql, gssapi, gnutls, udpspoof, omamqp1 From cee335df7d97c78dd9338fe98151f0fad9331788 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 20:02:28 +0000 Subject: [PATCH 04/41] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 867e492..6d8ce51 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -35,7 +35,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2210.0 -Release: 3%{?dist} +Release: 4%{?dist} License: (GPLv3+ and ASL 2.0) URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -757,6 +757,9 @@ done %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 8.2210.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Jan 17 2023 Attila Lakatos - 8.2210.0-3 - Remove CAP_PERFMON from the capability set - Add CAP_DAC_OVERRIDE to the capability set From 00eb7785d393eb8d62b9a33811ca96912d1e38ba Mon Sep 17 00:00:00 2001 From: Todd Zullinger Date: Wed, 10 May 2023 21:34:17 -0400 Subject: [PATCH 05/41] Use `systemctl reload` in logrotate script In 5f74814 (Use systemctl for sending SIGHUP to the service, 2015-06-29), a direct call to `kill` was replaced with `systemctl kill`. This can be simplified using `systemctl reload` instead. Doing so also resolves an issue when `POSIXLY_CORRECT` is set (rhbz#2124488). --- rsyslog.log | 2 +- rsyslog.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/rsyslog.log b/rsyslog.log index b101e32..42b31c8 100644 --- a/rsyslog.log +++ b/rsyslog.log @@ -7,6 +7,6 @@ missingok sharedscripts postrotate - /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true + /usr/bin/systemctl reload rsyslog.service >/dev/null 2>&1 || true endscript } diff --git a/rsyslog.spec b/rsyslog.spec index 6d8ce51..dfb6c1d 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -35,7 +35,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2210.0 -Release: 4%{?dist} +Release: 5%{?dist} License: (GPLv3+ and ASL 2.0) URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -757,6 +757,9 @@ done %changelog +* Wed May 10 2023 Todd Zullinger - 8.2210.0-5 +- Use 'systemctl reload' in logrotate script + * Fri Jan 20 2023 Fedora Release Engineering - 8.2210.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 2e07e95fe6daedfd3783febe9f46ad9402b4d7da Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 31 May 2023 10:22:06 +0200 Subject: [PATCH 06/41] Update License tag for SPDX --- rsyslog.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index dfb6c1d..9770566 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -36,7 +36,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2210.0 Release: 5%{?dist} -License: (GPLv3+ and ASL 2.0) +License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz Source1: http://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{version}.tar.gz From c9299748811187975207ed6c200555214aae9b57 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 31 May 2023 10:23:51 +0200 Subject: [PATCH 07/41] Fix deprecated %patchN --- rsyslog.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rsyslog.spec b/rsyslog.spec index 9770566..8aca4fe 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -383,11 +383,11 @@ mv build doc # Unpack qpid-proton %setup -q -D -T -b 6 pushd .. -%patch0 -p1 -b .openssl-compatibility +%patch -P 0 -p1 -b .openssl-compatibility popd %endif -%patch1 -p1 -b .libcap-ng +%patch -P 1 -p1 -b .libcap-ng %build %ifarch sparc64 From 88e628e1aa9d2832b1aeb9c45069beb446319ee9 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 21 Jun 2023 08:51:10 +0200 Subject: [PATCH 08/41] rebase to 8.2306.0 resolves: rhbz#2151339 resolves: rhbz#2151092 --- .gitignore | 2 + ...2210.0-rhbz2127403-drop-capabilities.patch | 261 ------------------ rsyslog.spec | 12 +- sources | 4 +- 4 files changed, 11 insertions(+), 268 deletions(-) delete mode 100644 rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch diff --git a/.gitignore b/.gitignore index 54c1f3c..ec39248 100644 --- a/.gitignore +++ b/.gitignore @@ -85,3 +85,5 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2204.0.tar.gz /rsyslog-8.2210.0.tar.gz /rsyslog-doc-8.2210.0.tar.gz +/rsyslog-8.2306.0.tar.gz +/rsyslog-doc-8.2306.0.tar.gz diff --git a/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch b/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch deleted file mode 100644 index cb583fb..0000000 --- a/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch +++ /dev/null @@ -1,261 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 9f73a708d0..958c26245e 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -377,6 +377,28 @@ AC_ARG_ENABLE(fmhash, - [enable_fmhash=yes] - ) - -+AC_ARG_ENABLE(libcap-ng, -+ [AS_HELP_STRING([--enable-libcap-ng],[Enable dropping capabilities to only the necessary set @<:@default=no@:>@])], -+ [case "${enableval}" in -+ yes) enable_libcapng="yes" ;; -+ no) enable_libcapng="no" ;; -+ *) AC_MSG_ERROR(bad value ${enableval} for --enable_libcapng) ;; -+ esac], -+ [enable_libcapng=no] -+) -+ -+if test "$enable_libcapng" = "yes"; then -+ PKG_CHECK_MODULES( -+ [LIBCAPNG], -+ [libcap-ng >= 0.8.2], -+ [AC_DEFINE([ENABLE_LIBCAPNG], [1], [Indicator that libcap-ng is present])], -+ [AC_MSG_ERROR(libcap-ng is not present.)] -+ ) -+ CFLAGS="$CFLAGS $LIBCAPNG_CFLAGS" -+ LIBS="$LIBS $LIBCAPNG_LIBS" -+fi -+ -+ - AC_ARG_ENABLE(fmhash-xxhash, - [AS_HELP_STRING([--enable-fmhash-xxhash],[Enable xxhash in fmhash support @<:@default=no@:>@])], - [case "${enableval}" in -@@ -2820,6 +2842,8 @@ echo " liblogging-stdlog support enabled: $enable_liblogging_stdlog" - echo " libsystemd enabled: $enable_libsystemd" - echo " kafka static linking enabled: $enable_kafka_static" - echo " atomic operations enabled: $enable_atomic_operations" -+echo " libcap-ng support enabled: $enable_libcapng" -+ - echo - echo "---{ input plugins }---" - if test "$unamestr" != "AIX"; then -diff --git a/runtime/debug.c b/runtime/debug.c -index a655bc2e4e..6e6c9fd38f 100644 ---- a/runtime/debug.c -+++ b/runtime/debug.c -@@ -250,7 +250,7 @@ r_dbgoprint( const char *srcname, obj_t *pObj, const char *fmt, ...) - - if(!(Debug && debugging_on)) - return; -- -+ - if(!checkDbgFile(srcname)) { - return; - } -@@ -435,7 +435,7 @@ rsRetVal dbgClassInit(void) - { - rsRetVal iRet; /* do not use DEFiRet, as this makes calls into the debug system! */ - -- -+ - (void) pthread_key_create(&keyThrdName, dbgThrdNameDestruct); - - /* while we try not to use any of the real rsyslog code (to avoid infinite loops), we -diff --git a/runtime/modules.c b/runtime/modules.c -index 810b2e9b52..b39bd9f066 100644 ---- a/runtime/modules.c -+++ b/runtime/modules.c -@@ -595,7 +595,7 @@ doModInit(pModInit_t modInit, uchar *name, void *pModHdlr, modInfo_t **pNewModul - CHKiRet((*pNew->modQueryEtryPt)((uchar*)"getKeepType", &modGetKeepType)); - CHKiRet((*modGetKeepType)(&pNew->eKeepType)); - dbgprintf("module %s of type %d being loaded (keepType=%d).\n", name, pNew->eType, pNew->eKeepType); -- -+ - /* OK, we know we can successfully work with the module. So we now fill the - * rest of the data elements. First we load the interfaces common to all - * module types. -@@ -1242,7 +1242,7 @@ Load(uchar *const pModName, const sbool bConfLoad, struct nvlst *const lst) - } - - iLoadCnt++; -- -+ - } while(pModHdlr == NULL && *pModName != '/' && pModDirNext); - - if(load_err_msg != NULL) { -@@ -1323,7 +1323,7 @@ modulesProcessCnf(struct cnfobj *o) - - cnfModName = (uchar*)es_str2cstr(pvals[typeIdx].val.d.estr, NULL); - iRet = Load(cnfModName, 1, o->nvlst); -- -+ - finalize_it: - free(cnfModName); - cnfparamvalsDestruct(pvals, &pblk); -diff --git a/runtime/rsconf.c b/runtime/rsconf.c -index 4620ff8d13..de2a21b406 100644 ---- a/runtime/rsconf.c -+++ b/runtime/rsconf.c -@@ -34,6 +34,10 @@ - #include - #include - #include -+#ifdef ENABLE_LIBCAPNG -+ #include -+#endif -+ - - #include "rsyslog.h" - #include "obj.h" -@@ -656,6 +660,7 @@ rsRetVal doDropPrivGid(rsconf_t *cnf) - uchar szBuf[1024]; - DEFiRet; - -+#ifndef ENABLE_LIBCAPNG - if(!cnf->globals.gidDropPrivKeepSupplemental) { - res = setgroups(0, NULL); /* remove all supplemental group IDs */ - if(res) { -@@ -668,9 +673,19 @@ rsRetVal doDropPrivGid(rsconf_t *cnf) - res = setgid(cnf->globals.gidDropPriv); - if(res) { - LogError(errno, RS_RET_ERR_DROP_PRIV, -- "could not set requested group id %d", cnf->globals.gidDropPriv); -+ "could not set requested group id %d via setgid()", cnf->globals.gidDropPriv); - ABORT_FINALIZE(RS_RET_ERR_DROP_PRIV); - } -+#else -+ int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP; -+ res = capng_change_id(-1, cnf->globals.gidDropPriv, capng_flags); -+ if (res) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not set requested group id %d via capng_change_id()", cnf->globals.gidDropPriv); -+ ABORT_FINALIZE(RS_RET_LIBCAPNG_ERR); -+ } -+#endif -+ - DBGPRINTF("setgid(%d): %d\n", cnf->globals.gidDropPriv, res); - snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's groupid changed to %d", - cnf->globals.gidDropPriv); -@@ -705,12 +720,18 @@ static void doDropPrivUid(rsconf_t *cnf) - cnf->globals.uidDropPriv); - } - -+#ifndef ENABLE_LIBCAPNG - res = setuid(cnf->globals.uidDropPriv); -+#else -+ int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP; -+ res = capng_change_id(cnf->globals.uidDropPriv, -1, capng_flags); -+#endif - if(res) { - /* if we can not set the userid, this is fatal, so let's unconditionally abort */ - perror("could not set requested userid"); - exit(1); - } -+ - DBGPRINTF("setuid(%d): %d\n", cnf->globals.uidDropPriv, res); - snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's userid changed to %d", cnf->globals.uidDropPriv); - logmsgInternal(NO_ERRCODE, LOG_SYSLOG|LOG_INFO, szBuf, 0); -@@ -739,6 +760,29 @@ dropPrivileges(rsconf_t *cnf) - cnf->globals.uidDropPriv); - } - -+#ifdef ENABLE_LIBCAPNG -+ /* In case privileges were dropped, do not allow bypassing -+ * file read, write, and execute permission checks -+ */ -+ if (cnf->globals.gidDropPriv != 0 || cnf->globals.uidDropPriv != 0) { -+ int capng_rc; -+ if ((capng_rc = capng_update(CAPNG_DROP, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_DAC_OVERRIDE)) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not update the internal posix capabilities settings " -+ "based on the options passed to it, capng_update=%d\n", capng_rc); -+ exit(-1); -+ } -+ -+ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not transfer the specified internal posix capabilities " -+ "settings to the kernel, capng_apply=%d\n", capng_rc); -+ exit(-1); -+ } -+ } -+ -+#endif -+ - finalize_it: - RETiRet; - } -diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h -index 908e5e7b73..01616d8f7d 100644 ---- a/runtime/rsyslog.h -+++ b/runtime/rsyslog.h -@@ -604,6 +604,7 @@ enum rsRetVal_ /** return value. All methods return this if not specified oth - RS_RET_REDIS_ERROR = -2452, /**< redis-specific error. See message foe details. */ - RS_RET_REDIS_AUTH_FAILED = -2453, /**< redis authentication failure */ - RS_RET_FAUP_INIT_OPTIONS_FAILED = -2454, /**< could not initialize faup options */ -+ RS_RET_LIBCAPNG_ERR = -2455, /**< error during dropping the capabilities */ - - /* RainerScript error messages (range 1000.. 1999) */ - RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */ -diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c -index 31b91a1bd1..77d814b482 100644 ---- a/tools/rsyslogd.c -+++ b/tools/rsyslogd.c -@@ -37,6 +37,9 @@ - #ifdef HAVE_LIBSYSTEMD - # include - #endif -+#ifdef ENABLE_LIBCAPNG -+ #include -+#endif - - #include "rsyslog.h" - #include "wti.h" -@@ -2167,6 +2170,46 @@ main(int argc, char **argv) - fjson_global_do_case_sensitive_comparison(0); - - dbgClassInit(); -+ -+#ifdef ENABLE_LIBCAPNG -+ /* -+ * Drop capabilities to the necessary set -+ */ -+ int capng_rc; -+ capng_clear(CAPNG_SELECT_BOTH); -+ -+ if ((capng_rc = capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, -+ CAP_BLOCK_SUSPEND, -+ CAP_CHOWN, -+ CAP_IPC_LOCK, -+ CAP_LEASE, -+ CAP_NET_ADMIN, -+ CAP_NET_BIND_SERVICE, -+ CAP_DAC_OVERRIDE, -+ CAP_SETGID, -+ CAP_SETUID, -+ CAP_SETPCAP, -+ CAP_SYS_ADMIN, -+ CAP_SYS_CHROOT, -+ CAP_SYS_RESOURCE, -+ CAP_SYSLOG, -+ -1 -+ )) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not update the internal posix capabilities settings " -+ "based on the options passed to it, capng_updatev=%d\n", capng_rc); -+ exit(-1); -+ } -+ -+ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not transfer the specified internal posix capabilities " -+ "settings to the kernel, capng_apply=%d\n", capng_rc); -+ exit(-1); -+ } -+ DBGPRINTF("Capabilities were dropped successfully\n"); -+#endif -+ - initAll(argc, argv); - #ifdef HAVE_LIBSYSTEMD - sd_notify(0, "READY=1"); diff --git a/rsyslog.spec b/rsyslog.spec index 8aca4fe..1e95405 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -34,8 +34,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2210.0 -Release: 5%{?dist} +Version: 8.2306.0 +Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -49,7 +49,6 @@ Source5: rsyslog.service Source6: qpid-proton-0.34.0.tar.gz Patch0: openssl3-compatibility.patch -Patch1: rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch BuildRequires: make BuildRequires: gcc @@ -387,8 +386,6 @@ pushd .. popd %endif -%patch -P 1 -p1 -b .libcap-ng - %build %ifarch sparc64 #sparc64 need big PIC @@ -757,6 +754,11 @@ done %changelog +* Wed Jun 21 2023 Attila Lakatos - 8.2306.0-1 +- rebase to 8.2306.0 + resolves: rhbz#2151339 + resolves: rhbz#2151092 + * Wed May 10 2023 Todd Zullinger - 8.2210.0-5 - Use 'systemctl reload' in logrotate script diff --git a/sources b/sources index 4004c45..114fa0f 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3 -SHA512 (rsyslog-8.2210.0.tar.gz) = c665b7f7a3c5ef31c9b62b50f815cfbb52db0cbe4a06934f4f1c3cd2a56fb49c319d33857ee92ab843aa5894cac16c16b8eccdf83714f31ab57a95049c4af231 -SHA512 (rsyslog-doc-8.2210.0.tar.gz) = e7847a9307a91fdf87d6cf91d2391eb75869679905b9598310c456fb3fe1864fc06dbdc649778f5b3788e47ffda0a6d89cb894258e55db441f7df7e74b0ae9f4 +SHA512 (rsyslog-8.2306.0.tar.gz) = 4012ea18d49efa75438aa225fec1daafcaadc216cd5c0ecceccdc34688940bbdca9eb19bd9c401e834b023d9b9a5a0870529f7b855bb64c796a55538639dadfc +SHA512 (rsyslog-doc-8.2306.0.tar.gz) = eb5df4285ed9f5afe884dae497ed77ad96050a9101e94c8d83125c893998094e27d4fad7b7a42391d72cfdc1bf2aeb9fac8f65d61d8aa5c49dda9d0cac81d777 From 0927f2c9f8e0bbeca8176464e2af6e9726b2d62a Mon Sep 17 00:00:00 2001 From: Yaroslav Fedevych Date: Sat, 15 Jul 2023 08:10:43 +0000 Subject: [PATCH 09/41] Specify qpid-proton's source as full URL to fix isolated builds The way qpid-proton's sources are specified, any automated build outside of RH infrastructure will fail as it won't know where to get them from. This makes the source a proper URL. --- rsyslog.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rsyslog.spec b/rsyslog.spec index 1e95405..530c452 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -35,7 +35,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2306.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -46,7 +46,7 @@ Source4: rsyslog.log Source5: rsyslog.service # Add qpid-proton as another source, enable omamqp1 module in a # separatae sub-package with it statically linked(see rhbz#1713427) -Source6: qpid-proton-0.34.0.tar.gz +Source6: https://archive.apache.org/dist/qpid/proton/0.34.0/qpid-proton-0.34.0.tar.gz Patch0: openssl3-compatibility.patch @@ -754,6 +754,9 @@ done %changelog +* Sat Jul 15 2023 Yaroslav Fedevych - 8.2306.0-2 +- Specify qpid-proton's source as full URL to fix isolated builds + * Wed Jun 21 2023 Attila Lakatos - 8.2306.0-1 - rebase to 8.2306.0 resolves: rhbz#2151339 From 0dd4435c2ebef1b64aa4863fc782996f5b52aaf2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 17:11:09 +0000 Subject: [PATCH 10/41] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 530c452..c5fbd54 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -35,7 +35,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2306.0 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -754,6 +754,9 @@ done %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 8.2306.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Sat Jul 15 2023 Yaroslav Fedevych - 8.2306.0-2 - Specify qpid-proton's source as full URL to fix isolated builds From c5f5013b306b06c29ef59c4f9d7d27e3e6d75625 Mon Sep 17 00:00:00 2001 From: Stewart Smith Date: Tue, 15 Aug 2023 01:03:29 +0000 Subject: [PATCH 11/41] Add mmtaghostname module It appears that some people are finding use for this rsyslog module, and it doesn't add any more build-dependencies for rsyslog. Add it as a bcond to make a more minimal rsyslog possible, as well as keeping the pattern of having all of these as options. Fixes: https://github.com/amazonlinux/amazon-linux-2023/issues/122 --- rsyslog.spec | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index c5fbd54..17c420f 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -31,11 +31,12 @@ %bcond_without pgsql %bcond_without snmp %bcond_without udpspoof +%bcond_without mmtaghostname Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2306.0 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -112,6 +113,12 @@ Requires: %name = %version-%release Summary: Fields extraction module Requires: %name = %version-%release +%if %{with mmtaghostname} +%package mmtaghostname +Summary: Message modification module supporting adding tags +Requires: %name = %version-%release +%endif + %if %{with snmp} %package mmsnmptrapd Summary: Message modification module for snmptrapd generated messages @@ -271,6 +278,9 @@ advantage if a field-based log format is to be processed, like for example CEF and either a large number of fields is needed or a specific field is used multiple times inside filters. +%description mmtaghostname +This module provides message modification for changing or adding the host name. + %if %{with snmp} %description mmsnmptrapd This message modification module takes messages generated from snmptrapd and @@ -488,6 +498,9 @@ autoreconf -if --enable-mmkubernetes \ --enable-mmjsonparse \ --enable-mmnormalize \ +%if %{with mmtaghostname} + --enable-mmtaghostname \ +%endif %if %{with snmp} --enable-mmsnmptrapd \ %endif @@ -665,6 +678,9 @@ done %files mmnormalize %{_libdir}/rsyslog/mmnormalize.so +%files mmtaghostname +%{_libdir}/rsyslog/mmtaghostname.so + %if %{with snmp} %files mmsnmptrapd %{_libdir}/rsyslog/mmsnmptrapd.so @@ -754,6 +770,9 @@ done %changelog +* Wed Aug 16 2023 Stewart Smith - 8.2306.0-4 +- Add mmtaghostname module as a subpackage + * Fri Jul 21 2023 Fedora Release Engineering - 8.2306.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 4cca27d51dfb82afabe0721ea0013d01d01fd149 Mon Sep 17 00:00:00 2001 From: alakatos Date: Fri, 25 Aug 2023 08:57:22 +0200 Subject: [PATCH 12/41] Rebase to 8.2308.0 --- .gitignore | 2 ++ rsyslog.spec | 7 +++++-- sources | 6 +++--- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index ec39248..34fa1a0 100644 --- a/.gitignore +++ b/.gitignore @@ -87,3 +87,5 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2210.0.tar.gz /rsyslog-8.2306.0.tar.gz /rsyslog-doc-8.2306.0.tar.gz +/rsyslog-8.2308.0.tar.gz +/rsyslog-doc-8.2308.0.tar.gz diff --git a/rsyslog.spec b/rsyslog.spec index 17c420f..8126ae1 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -35,8 +35,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2306.0 -Release: 4%{?dist} +Version: 8.2308.0 +Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -770,6 +770,9 @@ done %changelog +* Fri Aug 25 2023 Attila Lakatos - 8.2308.0-1 +- Rebase to 8.2308.0 + * Wed Aug 16 2023 Stewart Smith - 8.2306.0-4 - Add mmtaghostname module as a subpackage diff --git a/sources b/sources index 114fa0f..e22f0fc 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3 -SHA512 (rsyslog-8.2306.0.tar.gz) = 4012ea18d49efa75438aa225fec1daafcaadc216cd5c0ecceccdc34688940bbdca9eb19bd9c401e834b023d9b9a5a0870529f7b855bb64c796a55538639dadfc -SHA512 (rsyslog-doc-8.2306.0.tar.gz) = eb5df4285ed9f5afe884dae497ed77ad96050a9101e94c8d83125c893998094e27d4fad7b7a42391d72cfdc1bf2aeb9fac8f65d61d8aa5c49dda9d0cac81d777 +SHA512 (qpid-proton-0.34.0.tar.gz) = 6a72540b662ac121838d8cc32b9480e948f9953f87036c3bcb72d9e77b07ea41973ccd3c2513b64c56b4f53077708a893e42e13fd5792cf8c4bcbbc4d2384e23 +SHA512 (rsyslog-8.2308.0.tar.gz) = f8bcbbfe2c5c0a7e56203fc4ff285594cfa27fa7c998db2fe065a3f06b9bc30692626787c509b1f5d081a4b176680183b651625c5e3ccb4580ac59f3980ae8a5 +SHA512 (rsyslog-doc-8.2308.0.tar.gz) = f0a581e2a7642d100cdca94125c39cf00acfc3339114ddad067d726f1526941f52ab33c0f5789f9cbd4197b3e1f3c841da86c71886fa97306990193db8d6c935 From e050f5c5b53dfe8b380c24d2dc17100288a43975 Mon Sep 17 00:00:00 2001 From: alakatos Date: Tue, 10 Oct 2023 10:24:08 +0200 Subject: [PATCH 13/41] Rebase to 8.2310.0 resolves: rhbz#2232275 --- .gitignore | 3 +++ rsyslog.spec | 19 ++++++++----------- sources | 6 +++--- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 34fa1a0..0504cda 100644 --- a/.gitignore +++ b/.gitignore @@ -89,3 +89,6 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2306.0.tar.gz /rsyslog-8.2308.0.tar.gz /rsyslog-doc-8.2308.0.tar.gz +/qpid-proton-0.39.0.tar.gz +/rsyslog-8.2310.0.tar.gz +/rsyslog-doc-8.2310.0.tar.gz diff --git a/rsyslog.spec b/rsyslog.spec index 8126ae1..a3cf88b 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -1,6 +1,7 @@ %define rsyslog_statedir %{_sharedstatedir}/rsyslog %define rsyslog_pkidir %{_sysconfdir}/pki/rsyslog %define rsyslog_docdir %{_docdir}/rsyslog +%define qpid_proton_v 0.39.0 # The following packages are not enabled on rhel: # hiredis, libdbi, mongodb, rabbitmq # The omamqp1 plugin is built differently as qpid-proton is not available on rhel @@ -35,7 +36,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2308.0 +Version: 8.2310.0 Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ @@ -47,9 +48,7 @@ Source4: rsyslog.log Source5: rsyslog.service # Add qpid-proton as another source, enable omamqp1 module in a # separatae sub-package with it statically linked(see rhbz#1713427) -Source6: https://archive.apache.org/dist/qpid/proton/0.34.0/qpid-proton-0.34.0.tar.gz - -Patch0: openssl3-compatibility.patch +Source6: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz BuildRequires: make BuildRequires: gcc @@ -391,9 +390,6 @@ mv build doc %if %{with omamqp1} # Unpack qpid-proton %setup -q -D -T -b 6 -pushd .. -%patch -P 0 -p1 -b .openssl-compatibility -popd %endif %build @@ -407,7 +403,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fpic" %if %{with omamqp1} # build the proton first ( - cd %{_builddir}/qpid-proton-0.34.0 + cd %{_builddir}/qpid-proton-%{qpid_proton_v} mkdir bld cd bld @@ -469,7 +465,7 @@ autoreconf -if --enable-omrabbitmq \ %endif %if %{with omamqp1} - --enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-0.34.0/bld/c/include" \ + --enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ %endif --enable-elasticsearch \ --enable-generate-man-pages \ @@ -770,8 +766,9 @@ done %changelog -* Fri Aug 25 2023 Attila Lakatos - 8.2308.0-1 -- Rebase to 8.2308.0 +* Fri Aug 25 2023 Attila Lakatos - 8.2310.0-1 +- Rebase to 8.2310.0 + resolves: rhbz#2232275 * Wed Aug 16 2023 Stewart Smith - 8.2306.0-4 - Add mmtaghostname module as a subpackage diff --git a/sources b/sources index e22f0fc..cb9d7c3 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (qpid-proton-0.34.0.tar.gz) = 6a72540b662ac121838d8cc32b9480e948f9953f87036c3bcb72d9e77b07ea41973ccd3c2513b64c56b4f53077708a893e42e13fd5792cf8c4bcbbc4d2384e23 -SHA512 (rsyslog-8.2308.0.tar.gz) = f8bcbbfe2c5c0a7e56203fc4ff285594cfa27fa7c998db2fe065a3f06b9bc30692626787c509b1f5d081a4b176680183b651625c5e3ccb4580ac59f3980ae8a5 -SHA512 (rsyslog-doc-8.2308.0.tar.gz) = f0a581e2a7642d100cdca94125c39cf00acfc3339114ddad067d726f1526941f52ab33c0f5789f9cbd4197b3e1f3c841da86c71886fa97306990193db8d6c935 +SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b +SHA512 (rsyslog-8.2310.0.tar.gz) = f04e14ede8c35e1799eadc711a6e99dbe56d312c7909c7ebed4d4bd489d310a44a5c2d3ed23968fbf3ccff5b580870d0f3ceeb690deb1d1424420fc9d3220696 +SHA512 (rsyslog-doc-8.2310.0.tar.gz) = cf452f3705680fc81495e940ea7d5ae705a6dbfe0e2ce5a87865c3043f79daaec243df20e8aadd9fac6144a3df8f19d7c56fdf19ec68df78e2fdaffa45096143 From a2d2f9d9e8a34c1384669431fb2c7bf1350521c0 Mon Sep 17 00:00:00 2001 From: alakatos Date: Thu, 4 Jan 2024 13:03:18 +0100 Subject: [PATCH 14/41] Move rsyslog related logrotate config to the base package In the past, the logrotate script was part of the base package, but it has been moved to a separate package to reduce base package dependencies. It turned out to be a bad idea, because in some cases the logrotate subpackage was not installed and the logrotate config was missing. This turned off rotation of important logs, thus some logs could grow into extremely large files . --- rsyslog.spec | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/rsyslog.spec b/rsyslog.spec index a3cf88b..8bd55da 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2310.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -247,7 +247,10 @@ advanced features suitable for enterprise-class, encryption-protected syslog relay chains. %description logrotate -This subpackage contains the default logrotate configuration for rsyslog. +The rsyslog-logrotate subpackage acts as a dependency puller, ensuring the +presence of logrotate, a crucial tool for managing log files. Logrotate allows +for the periodic rotation, compression, and removal of log files to prevent +them from consuming excessive disk space. %description crypto This package contains a module providing log file encryption and a @@ -604,6 +607,7 @@ done %{_unitdir}/rsyslog.service %config(noreplace) %{_sysconfdir}/rsyslog.conf %config(noreplace) %{_sysconfdir}/sysconfig/rsyslog +%config(noreplace) %{_sysconfdir}/logrotate.d/rsyslog # plugins %{_libdir}/rsyslog/fmhash.so %{_libdir}/rsyslog/fmhttp.so @@ -648,9 +652,6 @@ done %{_libdir}/rsyslog/omclickhouse.so %endif -%files logrotate -%config(noreplace) %{_sysconfdir}/logrotate.d/rsyslog - %files crypto %{_bindir}/rscryutil %{_mandir}/man1/rscryutil.1.gz @@ -766,6 +767,10 @@ done %changelog +* Thu Jan 04 2024 Attila Lakatos - 8.2310.0-2 +- Move rsyslog related logrotate config to the base package + resolves: rhbz#2242243 + * Fri Aug 25 2023 Attila Lakatos - 8.2310.0-1 - Rebase to 8.2310.0 resolves: rhbz#2232275 From de23c1e0c8e337fe2ab3a9761e9f31378cfa9938 Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Fri, 5 Jan 2024 20:19:38 +0900 Subject: [PATCH 15/41] obsolete rsyslog-logrotate --- rsyslog.spec | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/rsyslog.spec b/rsyslog.spec index 8bd55da..cbd6c9b 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -70,18 +70,15 @@ BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel BuildRequires: libcap-ng-devel -Recommends: %{name}-logrotate = %version-%release +Recommends: logrotate +Obsoletes: rsyslog-logrotate < 8.2310.0-2 +Provides: rsyslog-logrotate = %{version}-%{release} Requires: bash >= 2.0 %{?systemd_ordering} Provides: syslog Obsoletes: sysklogd < 1.5-11 -%package logrotate -Summary: Log rotation for rsyslog -Requires: %name = %version-%release -Requires: logrotate >= 3.5.2 - %package crypto Summary: Encryption support Requires: %name = %version-%release @@ -246,12 +243,6 @@ and can be used as a drop-in replacement. Rsyslog is simple to set up, with advanced features suitable for enterprise-class, encryption-protected syslog relay chains. -%description logrotate -The rsyslog-logrotate subpackage acts as a dependency puller, ensuring the -presence of logrotate, a crucial tool for managing log files. Logrotate allows -for the periodic rotation, compression, and removal of log files to prevent -them from consuming excessive disk space. - %description crypto This package contains a module providing log file encryption and a command line tool to process encrypted logs. From 3f11b7ff782f536096aff4c06139619a03d62ea2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 22 Jan 2024 12:10:48 +0000 Subject: [PATCH 16/41] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index cbd6c9b..ba40593 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2310.0 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -758,6 +758,9 @@ done %changelog +* Mon Jan 22 2024 Fedora Release Engineering - 8.2310.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 04 2024 Attila Lakatos - 8.2310.0-2 - Move rsyslog related logrotate config to the base package resolves: rhbz#2242243 From eb3dcaa1b2c6c92862fa4841c9bf2401036a70be Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 16:26:43 +0000 Subject: [PATCH 17/41] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index ba40593..6016591 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2310.0 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -758,6 +758,9 @@ done %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 8.2310.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jan 22 2024 Fedora Release Engineering - 8.2310.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 1e6869a68124e0ab4b03c7ee98592e8047715cef Mon Sep 17 00:00:00 2001 From: alakatos Date: Mon, 12 Feb 2024 16:17:01 +0100 Subject: [PATCH 18/41] Rebase to 8.2312.0 resolves: rhbz#2232275 --- .gitignore | 2 ++ rsyslog.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0504cda..f331443 100644 --- a/.gitignore +++ b/.gitignore @@ -92,3 +92,5 @@ rsyslog-4.6.3.tar.gz /qpid-proton-0.39.0.tar.gz /rsyslog-8.2310.0.tar.gz /rsyslog-doc-8.2310.0.tar.gz +/rsyslog-8.2312.0.tar.gz +/rsyslog-doc-8.2312.0.tar.gz diff --git a/rsyslog.spec b/rsyslog.spec index 6016591..eb0110e 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -36,8 +36,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2310.0 -Release: 4%{?dist} +Version: 8.2312.0 +Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -758,6 +758,10 @@ done %changelog +* Mon Feb 12 2024 Attila Lakatos - 8.2312.0-1 +- Rebase to 8.2312.0 + resolves: rhbz#2232275 + * Fri Jan 26 2024 Fedora Release Engineering - 8.2310.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index cb9d7c3..d55fac4 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b -SHA512 (rsyslog-8.2310.0.tar.gz) = f04e14ede8c35e1799eadc711a6e99dbe56d312c7909c7ebed4d4bd489d310a44a5c2d3ed23968fbf3ccff5b580870d0f3ceeb690deb1d1424420fc9d3220696 -SHA512 (rsyslog-doc-8.2310.0.tar.gz) = cf452f3705680fc81495e940ea7d5ae705a6dbfe0e2ce5a87865c3043f79daaec243df20e8aadd9fac6144a3df8f19d7c56fdf19ec68df78e2fdaffa45096143 +SHA512 (rsyslog-8.2312.0.tar.gz) = a65ca1c6fe2d9dd853d073d93cfd4d007c3533bd10c633113fcf94c4746192945ed0a2b2ff84f9174b55de90ade2a062a0bd556ffe375864fad3772ef8ce39e3 +SHA512 (rsyslog-doc-8.2312.0.tar.gz) = 2fe8ab0e37a6899a545c09ea2586c33ab89a3e3d93ff079f99b15e9b1743423bbe54931684ba8509ed4f578a4b55ea22f6306aca256ee2245f88115a5f44e400 From 2189965d8382d804854e22e82d4cf05696e94c95 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 11 May 2024 15:44:22 -0700 Subject: [PATCH 19/41] rebuild for hiredis soname bump --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index eb0110e..c97a8d1 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2312.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -758,6 +758,9 @@ done %changelog +* Sat May 11 2024 Kevin Fenzi - 8.2312.0-2 +- rebuild for hiredis soname bump + * Mon Feb 12 2024 Attila Lakatos - 8.2312.0-1 - Rebase to 8.2312.0 resolves: rhbz#2232275 From 738d1ddec5aade671e1557248a0408cb7363eaea Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 29 May 2024 16:53:35 -0600 Subject: [PATCH 20/41] Explicitly set imjournal FileCreateMode to quiet warning --- rsyslog.conf | 1 + rsyslog.spec | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/rsyslog.conf b/rsyslog.conf index f6d3f6a..f2c718e 100644 --- a/rsyslog.conf +++ b/rsyslog.conf @@ -18,6 +18,7 @@ module(load="imuxsock" # provides support for local system logging (e.g. via SysSock.Use="off") # Turn off message reception via local log socket; # local messages are retrieved through imjournal now. module(load="imjournal" # provides access to the systemd journal + FileCreateMode="0600" # Quiet warning and ensure privacy StateFile="imjournal.state") # File to store the position in the journal # Include all config files in /etc/rsyslog.d/ diff --git a/rsyslog.spec b/rsyslog.spec index c97a8d1..64d2c11 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2312.0 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -758,6 +758,9 @@ done %changelog +* Wed May 29 2024 Orion Poplawski - 8.2312.0-3 +- Explicitly set imjournal FileCreateMode to quiet warning + * Sat May 11 2024 Kevin Fenzi - 8.2312.0-2 - rebuild for hiredis soname bump From ba510f5b7c301aaf45092997c6ee97c4638bfda7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 18:55:07 +0000 Subject: [PATCH 21/41] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 64d2c11..6f0d95b 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2312.0 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -758,6 +758,9 @@ done %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 8.2312.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Wed May 29 2024 Orion Poplawski - 8.2312.0-3 - Explicitly set imjournal FileCreateMode to quiet warning From 4a1805d718bc0503b3f9662e0469199dd154e759 Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Thu, 1 Aug 2024 15:17:12 -0700 Subject: [PATCH 22/41] openssl engine-related files have been moved to a sub-package, which rsyslog currently requires. --- rsyslog.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/rsyslog.spec b/rsyslog.spec index 6f0d95b..a03dfba 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -163,6 +163,7 @@ Group: System Environment/Daemons Requires: %name = %version-%release Requires: openssl-libs BuildRequires: openssl-devel +BuildRequires: openssl-devel-engine %endif %if %{with snmp} From 5d881b524c81126c4fc8908cf4b9d3db53bae4cd Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Thu, 1 Aug 2024 12:07:22 -0700 Subject: [PATCH 23/41] Examine the server process GOT for signs of tampering. --- .fmf/version | 1 + plans/main.fmf | 6 +++++ tests/got-audit/got-audit.gdb | 2 ++ tests/got-audit/main.fmf | 10 +++++++++ tests/got-audit/runtest.sh | 41 +++++++++++++++++++++++++++++++++++ tests/main.fmf | 2 ++ 6 files changed, 62 insertions(+) create mode 100644 .fmf/version create mode 100644 plans/main.fmf create mode 100644 tests/got-audit/got-audit.gdb create mode 100644 tests/got-audit/main.fmf create mode 100755 tests/got-audit/runtest.sh create mode 100644 tests/main.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..ae0c305 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,6 @@ +summary: Run all tests +execute: + how: tmt +discover: + how: fmf + diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/tests/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf new file mode 100644 index 0000000..a90b249 --- /dev/null +++ b/tests/got-audit/main.fmf @@ -0,0 +1,10 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit + diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh new file mode 100755 index 0000000..03761a1 --- /dev/null +++ b/tests/got-audit/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/rsyslog/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlServiceStart rsyslog + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID rsyslog.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore rsyslog + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/main.fmf b/tests/main.fmf new file mode 100644 index 0000000..f225a72 --- /dev/null +++ b/tests/main.fmf @@ -0,0 +1,2 @@ +test: ./runtest.sh +framework: beakerlib From 10928b130757f01b48acebd45ce8c1e4bed3b311 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 21 Aug 2024 13:31:38 +0200 Subject: [PATCH 24/41] Rebase to 8.2408.0 Resolves: rhbz#2266329 Resolves: rhbz#2301246 Resolves: rhbz#2305398 --- .gitignore | 2 ++ rsyslog.spec | 14 +++++++++++--- sources | 4 ++-- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f331443..2674446 100644 --- a/.gitignore +++ b/.gitignore @@ -94,3 +94,5 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2310.0.tar.gz /rsyslog-8.2312.0.tar.gz /rsyslog-doc-8.2312.0.tar.gz +/rsyslog-8.2408.0.tar.gz +/rsyslog-doc-8.2408.0.tar.gz diff --git a/rsyslog.spec b/rsyslog.spec index a03dfba..3e0bd84 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -36,8 +36,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2312.0 -Release: 4%{?dist} +Version: 8.2408.0 +Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -521,7 +521,9 @@ autoreconf -if --enable-snmp \ %endif --enable-unlimited-select \ - --enable-usertools + --enable-usertools \ + --disable-libgcrypt \ + --enable-openssl_crypto_provider make V=1 @@ -759,6 +761,12 @@ done %changelog +* Wed Aug 21 2024 Attila Lakatos - 8.2408.0-1 +- Rebase to 8.2408.0 + Resolves: rhbz#2266329 + Resolves: rhbz#2301246 + Resolves: rhbz#2305398 + * Fri Jul 19 2024 Fedora Release Engineering - 8.2312.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index d55fac4..f364de8 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b -SHA512 (rsyslog-8.2312.0.tar.gz) = a65ca1c6fe2d9dd853d073d93cfd4d007c3533bd10c633113fcf94c4746192945ed0a2b2ff84f9174b55de90ade2a062a0bd556ffe375864fad3772ef8ce39e3 -SHA512 (rsyslog-doc-8.2312.0.tar.gz) = 2fe8ab0e37a6899a545c09ea2586c33ab89a3e3d93ff079f99b15e9b1743423bbe54931684ba8509ed4f578a4b55ea22f6306aca256ee2245f88115a5f44e400 +SHA512 (rsyslog-8.2408.0.tar.gz) = 86901f76290aa451dfc8dc3d2c7eb2ea82bdbf39875fe2872169a3aa44933aff064dd5ea9b80964881fd07c34c17da25ec6a0efc1c5b7f4d6884435639fa0338 +SHA512 (rsyslog-doc-8.2408.0.tar.gz) = 9982688880b8362ca2ecd5f076f12aaf31b966144bd9b291761e660307e4c31e8c3ccc17b6b2b0cb2ccf2e30ba81927126991f9539562c2f02966a59fd1624aa From 9e24c81c5953333e0962c35d36587056fe902236 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 21 Aug 2024 14:04:07 +0200 Subject: [PATCH 25/41] Remove dependency on libgcrypt --- rsyslog.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 3e0bd84..3589a26 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -57,7 +57,6 @@ BuildRequires: automake BuildRequires: bison BuildRequires: dos2unix BuildRequires: flex -BuildRequires: libgcrypt-devel BuildRequires: libfastjson-devel >= 0.99.8 BuildRequires: libestr-devel >= 0.1.9 BuildRequires: libtool From 21c818925fa0abdb31a23c7cbe189340ae4f0f47 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 21 Aug 2024 14:15:06 +0200 Subject: [PATCH 26/41] Replace gcry crypto driver with ossl --- rsyslog.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 3589a26..8351da8 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -648,7 +648,7 @@ done %files crypto %{_bindir}/rscryutil %{_mandir}/man1/rscryutil.1.gz -%{_libdir}/rsyslog/lmcry_gcry.so +%{_libdir}/rsyslog/lmcry_ossl.so %files doc %doc %{rsyslog_docdir}/html From 546fde3d353a1398e7c9905690bc6fe7a3c64ff2 Mon Sep 17 00:00:00 2001 From: Cropi Date: Fri, 4 Oct 2024 09:13:00 +0200 Subject: [PATCH 27/41] Rebuild package Resolves: rhzb#2316361 --- rsyslog.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 8351da8..e538d90 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2408.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -760,6 +760,10 @@ done %changelog +* Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 +- Rebuild package + Resolves: rhzb#2316361 + * Wed Aug 21 2024 Attila Lakatos - 8.2408.0-1 - Rebase to 8.2408.0 Resolves: rhbz#2266329 From 1064c4ef0e43bcc337ad3bfe070699530e657b23 Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 5 Dec 2024 09:53:46 +0100 Subject: [PATCH 28/41] Rebase to 8.2412.0 Resolves: rhbz#2320050 --- .gitignore | 2 ++ rsyslog.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 2674446..ff0224a 100644 --- a/.gitignore +++ b/.gitignore @@ -96,3 +96,5 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2312.0.tar.gz /rsyslog-8.2408.0.tar.gz /rsyslog-doc-8.2408.0.tar.gz +/rsyslog-8.2412.0.tar.gz +/rsyslog-doc-8.2412.0.tar.gz diff --git a/rsyslog.spec b/rsyslog.spec index e538d90..462eb3c 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -36,8 +36,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2408.0 -Release: 2%{?dist} +Version: 8.2412.0 +Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -760,6 +760,10 @@ done %changelog +* Thu Dec 05 2024 Attila Lakatos - 8.2412.0-1 +- Rebase to 8.2412.0 + Resolves: rhbz#2320050 + * Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 - Rebuild package Resolves: rhzb#2316361 diff --git a/sources b/sources index f364de8..380a910 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b -SHA512 (rsyslog-8.2408.0.tar.gz) = 86901f76290aa451dfc8dc3d2c7eb2ea82bdbf39875fe2872169a3aa44933aff064dd5ea9b80964881fd07c34c17da25ec6a0efc1c5b7f4d6884435639fa0338 -SHA512 (rsyslog-doc-8.2408.0.tar.gz) = 9982688880b8362ca2ecd5f076f12aaf31b966144bd9b291761e660307e4c31e8c3ccc17b6b2b0cb2ccf2e30ba81927126991f9539562c2f02966a59fd1624aa +SHA512 (rsyslog-8.2412.0.tar.gz) = fdd8bb096c9578fe2c4ed8cdb13179d7b3333d0f9be1b2c921b5b040f1e1414c3f9f8106e44444aaefba22f235a44d17c0c5b80cd114fe540a2aebb30e3eba72 +SHA512 (rsyslog-doc-8.2412.0.tar.gz) = 9b5d453b5774b027a6a4ba232133953d8a8058df4bfff31f835504656d7b01008cec5c0d28667bed0052799cf7389c0bafea7c76c3190bdcdf3d8a2eedf19b4e From 9279438445fd22e8bac472c20bc2e129ccd5ed75 Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 5 Dec 2024 09:54:15 +0100 Subject: [PATCH 29/41] Harden service file --- rsyslog.service | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/rsyslog.service b/rsyslog.service index 9c13b1d..738f087 100644 --- a/rsyslog.service +++ b/rsyslog.service @@ -3,6 +3,8 @@ Description=System Logging Service ;Requires=syslog.socket Documentation=man:rsyslogd(8) Documentation=https://www.rsyslog.com/doc/ +Wants=network.target network-online.target +After=network.target network-online.target [Service] Type=notify @@ -12,6 +14,19 @@ ExecReload=/usr/bin/kill -HUP $MAINPID UMask=0066 StandardOutput=null Restart=on-failure +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=net +NoNewPrivileges=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete +LockPersonality=yes +MemoryDenyWriteExecute=yes + # Increase the default a bit in order to allow many simultaneous # files to be monitored, we might need a lot of fds. From ae8648a28874f055af5aadfd302e4c7f92ea0e34 Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 5 Dec 2024 09:57:42 +0100 Subject: [PATCH 30/41] Disable openssl engines support --- disable-openssl-engine.patch | 60 ++++++++++++++++++++++++++++++++++++ rsyslog.spec | 6 +++- 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 disable-openssl-engine.patch diff --git a/disable-openssl-engine.patch b/disable-openssl-engine.patch new file mode 100644 index 0000000..20ba01e --- /dev/null +++ b/disable-openssl-engine.patch @@ -0,0 +1,60 @@ +diff -up rsyslog-8.2412.0/runtime/net_ossl.c.orig rsyslog-8.2412.0/runtime/net_ossl.c +--- rsyslog-8.2412.0/runtime/net_ossl.c.orig 2024-11-27 13:05:51.327988286 +0100 ++++ rsyslog-8.2412.0/runtime/net_ossl.c 2024-11-27 13:06:26.806335104 +0100 +@@ -220,6 +220,7 @@ osslGlblInit(void) + ERR_load_crypto_strings(); + #endif + ++#ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM + PRAGMA_DIAGNOSTIC_PUSH + PRAGMA_IGNORE_Wdeprecated_declarations + +@@ -244,6 +245,8 @@ PRAGMA_IGNORE_Wdeprecated_declarations + // Free the engine reference when done + ENGINE_free(osslEngine); + PRAGMA_DIAGNOSTIC_POP ++#endif ++ + } + + /* globally de-initialize OpenSSL */ +@@ -251,7 +254,9 @@ void + osslGlblExit(void) + { + DBGPRINTF("openssl: entering osslGlblExit\n"); ++ #ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM + ENGINE_cleanup(); ++ #endif + ERR_free_strings(); + EVP_cleanup(); + CRYPTO_cleanup_all_ex_data(); +@@ -1149,6 +1154,7 @@ net_ossl_init_engine(__attribute__((unus + const char *engine_id = NULL; + const char *engine_name = NULL; + ++#ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM + PRAGMA_DIAGNOSTIC_PUSH + PRAGMA_IGNORE_Wdeprecated_declarations + // Get the default RSA engine +@@ -1189,7 +1195,7 @@ PRAGMA_IGNORE_Wdeprecated_declarations + DBGPRINTF("net_ossl_init_engine: use openssl default Engine"); + } + PRAGMA_DIAGNOSTIC_POP +- ++#endif // ENABLE_OPENSSL_ENGINES_DOWNSTREAM + RETiRet; + } + +diff -up rsyslog-8.2412.0/runtime/net_ossl.h.orig rsyslog-8.2412.0/runtime/net_ossl.h +--- rsyslog-8.2412.0/runtime/net_ossl.h.orig 2024-11-27 13:06:01.138084180 +0100 ++++ rsyslog-8.2412.0/runtime/net_ossl.h 2024-11-27 13:06:30.536372456 +0100 +@@ -31,7 +31,9 @@ + #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) + # include + #endif ++#ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM + #include ++#endif + #include + #include + diff --git a/rsyslog.spec b/rsyslog.spec index 462eb3c..77d92d4 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -69,6 +69,8 @@ BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel BuildRequires: libcap-ng-devel +Patch0: disable-openssl-engine.patch + Recommends: logrotate Obsoletes: rsyslog-logrotate < 8.2310.0-2 Provides: rsyslog-logrotate = %{version}-%{release} @@ -162,7 +164,6 @@ Group: System Environment/Daemons Requires: %name = %version-%release Requires: openssl-libs BuildRequires: openssl-devel -BuildRequires: openssl-devel-engine %endif %if %{with snmp} @@ -380,6 +381,7 @@ rm -r LICENSE README.md source build/objects.inv mv build doc # set up rsyslog sources %setup -q -D +%patch -P 0 -p1 %if %{with omamqp1} # Unpack qpid-proton @@ -762,6 +764,8 @@ done %changelog * Thu Dec 05 2024 Attila Lakatos - 8.2412.0-1 - Rebase to 8.2412.0 +- Harden rsyslog service unit +- Disable openssl engines support Resolves: rhbz#2320050 * Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 From cb8e5c624a25d0d32c9326206d67d9fe672e2141 Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 5 Dec 2024 10:36:21 +0100 Subject: [PATCH 31/41] Add UsePid option to imjournal --- rsyslog.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/rsyslog.conf b/rsyslog.conf index f2c718e..4486f1f 100644 --- a/rsyslog.conf +++ b/rsyslog.conf @@ -19,6 +19,7 @@ module(load="imuxsock" # provides support for local system logging (e.g. via # local messages are retrieved through imjournal now. module(load="imjournal" # provides access to the systemd journal FileCreateMode="0600" # Quiet warning and ensure privacy + UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from StateFile="imjournal.state") # File to store the position in the journal # Include all config files in /etc/rsyslog.d/ From b019afff9ac4bc582d00bfd275f206ea83f91afd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 22:49:26 +0000 Subject: [PATCH 32/41] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 77d92d4..333a978 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2412.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -762,6 +762,9 @@ done %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 8.2412.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Thu Dec 05 2024 Attila Lakatos - 8.2412.0-1 - Rebase to 8.2412.0 - Harden rsyslog service unit From b80cab473af65b2e3b503fc5b5cb115162065857 Mon Sep 17 00:00:00 2001 From: Cropi Date: Tue, 21 Jan 2025 09:51:47 +0100 Subject: [PATCH 33/41] Fix build problem by making gnu23 compatible --- gnu23.patch | 354 +++++++++++++++++++++++++++++++++++++++++++++++++++ rsyslog.spec | 7 +- 2 files changed, 360 insertions(+), 1 deletion(-) create mode 100644 gnu23.patch diff --git a/gnu23.patch b/gnu23.patch new file mode 100644 index 0000000..d671459 --- /dev/null +++ b/gnu23.patch @@ -0,0 +1,354 @@ +diff --git a/runtime/cfsysline.c b/runtime/cfsysline.c +index 06fdb4bb05..a9ba2684ec 100644 +--- a/runtime/cfsysline.c ++++ b/runtime/cfsysline.c +@@ -723,46 +723,46 @@ int *permitted) + static rsRetVal cslchCallHdlr(cslCmdHdlr_t *pThis, uchar **ppConfLine) + { + DEFiRet; +- rsRetVal (*pHdlr)() = NULL; ++ rsRetVal (*pHdlr)(void *, ...) = NULL; + assert(pThis != NULL); + assert(ppConfLine != NULL); + + switch(pThis->eType) { + case eCmdHdlrCustomHandler: +- pHdlr = doCustomHdlr; ++ pHdlr = (rsRetVal (*)(void *, ...)) doCustomHdlr; + break; + case eCmdHdlrUID: +- pHdlr = doGetUID; ++ pHdlr = (rsRetVal (*)(void *, ...)) doGetUID; + break; + case eCmdHdlrGID: +- pHdlr = doGetGID; ++ pHdlr = (rsRetVal (*)(void *, ...)) doGetGID; + break; + case eCmdHdlrBinary: +- pHdlr = doBinaryOptionLine; ++ pHdlr = (rsRetVal (*)(void *, ...)) doBinaryOptionLine; + break; + case eCmdHdlrFileCreateMode: +- pHdlr = doFileCreateMode; ++ pHdlr = (rsRetVal (*)(void *, ...)) doFileCreateMode; + break; + case eCmdHdlrInt: +- pHdlr = doGetInt; ++ pHdlr = (rsRetVal (*)(void *, ...)) doGetInt; + break; + case eCmdHdlrSize: +- pHdlr = doGetSize; ++ pHdlr = (rsRetVal (*)(void *, ...)) doGetSize; + break; + case eCmdHdlrGetChar: +- pHdlr = doGetChar; ++ pHdlr = (rsRetVal (*)(void *, ...)) doGetChar; + break; + case eCmdHdlrFacility: +- pHdlr = doFacility; ++ pHdlr = (rsRetVal (*)(void *, ...)) doFacility; + break; + case eCmdHdlrSeverity: +- pHdlr = doSeverity; ++ pHdlr = (rsRetVal (*)(void *, ...)) doSeverity; + break; + case eCmdHdlrGetWord: +- pHdlr = doGetWord; ++ pHdlr = (rsRetVal (*)(void *, ...)) doGetWord; + break; + case eCmdHdlrGoneAway: +- pHdlr = doGoneAway; ++ pHdlr = (rsRetVal (*)(void *, ...)) doGoneAway; + break; + /* some non-legacy handler (used in v6+ solely) */ + case eCmdHdlrInvalid: +@@ -827,7 +827,7 @@ static rsRetVal cslcConstruct(cslCmd_t **ppThis, int bChainingPermitted) + + pThis->bChainingPermitted = bChainingPermitted; + +- CHKiRet(llInit(&pThis->llCmdHdlrs, cslchDestruct, cslchKeyDestruct, cslchKeyCompare)); ++ CHKiRet(llInit(&pThis->llCmdHdlrs, cslchDestruct, cslchKeyDestruct, (int (*) (void*, void*)) cslchKeyCompare)); + + finalize_it: + *ppThis = pThis; +@@ -1074,7 +1074,7 @@ cfsyslineInit(void) + DEFiRet; + CHKiRet(objGetObjInterface(&obj)); + +- CHKiRet(llInit(&llCmdList, cslcDestruct, cslcKeyDestruct, strcasecmp)); ++ CHKiRet(llInit(&llCmdList, cslcDestruct, cslcKeyDestruct, (int (*)(void*, void*)) strcasecmp)); + + finalize_it: + RETiRet; +diff --git a/runtime/linkedlist.c b/runtime/linkedlist.c +index 70887379b2..499629399b 100644 +--- a/runtime/linkedlist.c ++++ b/runtime/linkedlist.c +@@ -43,7 +43,7 @@ + * pKey destructor may be zero to take care of non-keyed lists. + */ + rsRetVal llInit(linkedList_t *pThis, rsRetVal (*pEltDestructor)(void*), rsRetVal (*pKeyDestructor)(void*), +-int (*pCmpOp)(void*,void*)) ++ int (*pCmpOp)(void*,void*)) + { + assert(pThis != NULL); + assert(pEltDestructor != NULL); +diff --git a/runtime/linkedlist.h b/runtime/linkedlist.h +index 1cd3a143f2..9894541889 100644 +--- a/runtime/linkedlist.h ++++ b/runtime/linkedlist.h +@@ -52,7 +52,8 @@ typedef struct linkedList_s linkedList_t; + typedef llElt_t* linkedListCookie_t; /* this type avoids exposing internals and keeps us flexible */ + + /* prototypes */ +-rsRetVal llInit(linkedList_t *pThis, rsRetVal (*pEltDestructor)(), rsRetVal (*pKeyDestructor)(), int (*pCmpOp)()); ++rsRetVal llInit(linkedList_t *pThis, rsRetVal (*pEltDestructor)(void*), ++ rsRetVal (*pKeyDestructor)(void*), int (*pCmpOp)(void*,void*)); + rsRetVal llDestroy(linkedList_t *pThis); + rsRetVal llDestroyRootElt(linkedList_t *pThis); + rsRetVal llGetNextElt(linkedList_t *pThis, linkedListCookie_t *ppElt, void **ppUsr); +diff --git a/runtime/obj-types.h b/runtime/obj-types.h +index 21fb89bbe1..b708d6fc9e 100644 +--- a/runtime/obj-types.h ++++ b/runtime/obj-types.h +@@ -5,7 +5,7 @@ + * that loop somehow and I've done that by moving the typedefs + * into this file here. + * +- * Copyright 2008-2019 Rainer Gerhards and Adiscon GmbH. ++ * Copyright 2008-2024 Rainer Gerhards and Adiscon GmbH. + * + * This file is part of the rsyslog runtime library. + * +@@ -74,7 +74,7 @@ struct objInfo_s { + size_t lenID; /* length of the ID string */ + int iObjVers; + uchar *pszName; +- rsRetVal (*objMethods[OBJ_NUM_METHODS])(); ++ rsRetVal (*objMethods[OBJ_NUM_METHODS])(void*, ...); + rsRetVal (*QueryIF)(interface_t*); + struct modInfo_s *pModInfo; + }; +diff --git a/runtime/obj.c b/runtime/obj.c +index 03a56f7a3a..4fa39772f0 100644 +--- a/runtime/obj.c ++++ b/runtime/obj.c +@@ -48,7 +48,7 @@ + * + * File begun on 2008-01-04 by RGerhards + * +- * Copyright 2008-2019 Rainer Gerhards and Adiscon GmbH. ++ * Copyright 2008-2024 Rainer Gerhards and Adiscon GmbH. + * + * This file is part of the rsyslog runtime library. + * +@@ -125,7 +125,7 @@ static rsRetVal objInfoNotImplementedDummy(void __attribute__((unused)) *pThis) + * must be provided an objInfo_t pointer. + */ + #define objInfoIsImplemented(pThis, method) \ +- (pThis->objMethods[method] != objInfoNotImplementedDummy) ++ (pThis->objMethods[method] != (rsRetVal (*)(void *, ...)) objInfoNotImplementedDummy) + + /* construct an object Info object. Each class shall do this on init. The + * resulting object shall be cached during the lifetime of the class and each +@@ -154,10 +154,10 @@ InfoConstruct(objInfo_t **ppThis, uchar *pszID, int iObjVers, + pThis->QueryIF = pQueryIF; + pThis->pModInfo = pModInfo; + +- pThis->objMethods[0] = pConstruct; +- pThis->objMethods[1] = pDestruct; ++ pThis->objMethods[0] = (rsRetVal (*)(void *, ...)) pConstruct; ++ pThis->objMethods[1] = (rsRetVal (*)(void *, ...)) pDestruct; + for(i = 2 ; i < OBJ_NUM_METHODS ; ++i) { +- pThis->objMethods[i] = objInfoNotImplementedDummy; ++ pThis->objMethods[i] = (rsRetVal (*)(void *, ...)) objInfoNotImplementedDummy; + } + + *ppThis = pThis; +@@ -192,7 +192,7 @@ InfoDestruct(objInfo_t **ppThis) + static rsRetVal + InfoSetMethod(objInfo_t *pThis, objMethod_t objMethod, rsRetVal (*pHandler)(void*)) + { +- pThis->objMethods[objMethod] = pHandler; ++ pThis->objMethods[objMethod] = (rsRetVal (*)(void *, ...)) pHandler; + return RS_RET_OK; + } + +@@ -786,7 +786,7 @@ static rsRetVal objDeserializeTryRecover(strm_t *pStrm) + * of the trailer. Header must already have been processed. + * rgerhards, 2008-01-11 + */ +-static rsRetVal objDeserializeProperties(obj_t *pObj, rsRetVal (*objSetProperty)(), strm_t *pStrm) ++static rsRetVal objDeserializeProperties(obj_t *pObj, rsRetVal (*objSetProperty)(void*, ...), strm_t *pStrm) + { + DEFiRet; + var_t *pVar = NULL; +@@ -867,7 +867,8 @@ Deserialize(void *ppObj, uchar *pszTypeExpected, strm_t *pStrm, rsRetVal (*fFixu + CHKiRet(pObjInfo->objMethods[objMethod_CONSTRUCT](&pObj)); + + /* we got the object, now we need to fill the properties */ +- CHKiRet(objDeserializeProperties(pObj, pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); ++ CHKiRet(objDeserializeProperties(pObj, ++ (rsRetVal (*)(void*, ...)) pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); + + /* check if we need to call a fixup function that modifies the object + * before it is finalized. -- rgerhards, 2008-01-13 +@@ -898,8 +899,10 @@ Deserialize(void *ppObj, uchar *pszTypeExpected, strm_t *pStrm, rsRetVal (*fFixu + */ + rsRetVal + objDeserializeWithMethods(void *ppObj, uchar *pszTypeExpected, int lenTypeExpected, strm_t *pStrm, +-rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, rsRetVal (*objConstruct)(), rsRetVal (*objConstructFinalize)(), +-rsRetVal (*objDeserialize)()) ++ rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, ++ rsRetVal (*objConstruct)(void *, ...), ++ rsRetVal (*objConstructFinalize)(void *, ...), ++ rsRetVal (*objDeserialize)(void *, ...)) + { + DEFiRet; + rsRetVal iRetLocal; +@@ -1007,7 +1010,8 @@ DeserializePropBag(obj_t *pObj, strm_t *pStrm) + CHKiRet(FindObjInfo((char*)cstrGetSzStrNoNULL(pstrID), &pObjInfo)); + + /* we got the object, now we need to fill the properties */ +- CHKiRet(objDeserializeProperties(pObj, pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); ++ CHKiRet(objDeserializeProperties(pObj, ++ (rsRetVal (*)(void*, ...)) pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); + + finalize_it: + if(pstrID != NULL) +diff --git a/runtime/obj.h b/runtime/obj.h +index 0efe6e7081..455cb873f5 100644 +--- a/runtime/obj.h ++++ b/runtime/obj.h +@@ -21,7 +21,7 @@ + * + * pThis always references to a pointer of the object. + * +- * Copyright 2008-2018 Adiscon GmbH. ++ * Copyright 2008-2024 Adiscon GmbH. + * + * This file is part of the rsyslog runtime library. + * +@@ -119,9 +119,12 @@ ENDinterface(obj) + rsRetVal objGetObjInterface(obj_if_t *pIf); + PROTOTYPEObjClassInit(obj); + PROTOTYPEObjClassExit(obj); +-rsRetVal objDeserializeWithMethods(void *ppObj, uchar *pszTypeExpected, int lenTypeExpected, strm_t *pStrm, +-rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, rsRetVal (*objConstruct)(), rsRetVal (*objConstructFinalize)(), +-rsRetVal (*objDeserialize)()); ++rsRetVal ++objDeserializeWithMethods(void *ppObj, uchar *pszTypeExpected, int lenTypeExpected, strm_t *pStrm, ++ rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, ++ rsRetVal (*objConstruct)(void *, ...), ++ rsRetVal (*objConstructFinalize)(void *, ...), ++ rsRetVal (*objDeserialize)(void*, ...)); + rsRetVal objDeserializeProperty(var_t *pProp, strm_t *pStrm); + uchar *objGetName(obj_t *pThis); + +diff --git a/runtime/queue.c b/runtime/queue.c +index edc9d3513b..e17da6d7c3 100644 +--- a/runtime/queue.c ++++ b/runtime/queue.c +@@ -1063,7 +1063,8 @@ qDeqDisk(qqueue_t *pThis, smsg_t **ppMsg) + DEFiRet; + iRet = objDeserializeWithMethods(ppMsg, (uchar*) "msg", 3, + pThis->tVars.disk.pReadDeq, NULL, +- NULL, msgConstructForDeserializer, NULL, MsgDeserialize); ++ NULL, (rsRetVal (*)(void *, ...)) msgConstructForDeserializer, NULL, ++ (rsRetVal (*)(void *, ...)) MsgDeserialize); + if(iRet != RS_RET_OK) { + LogError(0, iRet, "%s: qDeqDisk error happened at around offset %lld", + obj.GetName((obj_t*)pThis), +diff --git a/runtime/rsconf.c b/runtime/rsconf.c +index 71b31be3cd..a0d735d423 100644 +--- a/runtime/rsconf.c ++++ b/runtime/rsconf.c +@@ -290,7 +290,7 @@ BEGINobjConstruct(rsconf) /* be sure to specify the object type also in END macr + CHKiRet(dynstats_initCnf(&pThis->dynstats_buckets)); + CHKiRet(perctile_initCnf(&pThis->perctile_buckets)); + CHKiRet(llInit(&pThis->rulesets.llRulesets, rulesetDestructForLinkedList, +- rulesetKeyDestruct, strcasecmp)); ++ rulesetKeyDestruct, (int (*)(void*, void*)) strcasecmp)); + finalize_it: + ENDobjConstruct(rsconf) + +diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h +index 94b6605e8b..f98a5db3c7 100644 +--- a/runtime/rsyslog.h ++++ b/runtime/rsyslog.h +@@ -52,7 +52,9 @@ + * being emitted where nobody knows what the mean and why they appear :-( + */ + #pragma GCC diagnostic ignored "-Wjump-misses-init" +- #endif /* if __GNUC__ >= 8 */ ++ #pragma GCC diagnostic ignored "-Wincompatible-pointer-types" ++ #pragma GCC diagnostic ignored "-Wcast-function-type" ++ #endif + + #if defined(__clang__) + #define ATTR_NO_SANITIZE_UNDEFINED __attribute__((no_sanitize("undefined"))) +diff --git a/runtime/ruleset.c b/runtime/ruleset.c +index c137ee3b01..228283c28c 100644 +--- a/runtime/ruleset.c ++++ b/runtime/ruleset.c +@@ -888,7 +888,7 @@ destructAllActions(rsconf_t *conf) + + CHKiRet(llDestroy(&(conf->rulesets.llRulesets))); + CHKiRet(llInit(&(conf->rulesets.llRulesets), rulesetDestructForLinkedList, +- rulesetKeyDestruct, strcasecmp)); ++ rulesetKeyDestruct, (int (*)(void*, void*)) strcasecmp)); + conf->rulesets.pDflt = NULL; + + finalize_it: +diff --git a/tests/sndrcv_tls_anon_rebind.sh b/tests/sndrcv_tls_anon_rebind.sh +index dcd1e6e985..e3ae592a10 100755 +--- a/tests/sndrcv_tls_anon_rebind.sh ++++ b/tests/sndrcv_tls_anon_rebind.sh +@@ -3,6 +3,7 @@ + # rgerhards, 2011-04-04 + # This file is part of the rsyslog project, released under GPLv3 + . ${srcdir:=.}/diag.sh init ++skip_platform "SunOS" "Test fails with environment-induced errors, which we cannot solve" + + export NUMMESSAGES=25000 #25000 + +diff --git a/tests/sndrcv_tls_client_missing_cert.sh b/tests/sndrcv_tls_client_missing_cert.sh +index aa0c320244..c0c651706d 100755 +--- a/tests/sndrcv_tls_client_missing_cert.sh ++++ b/tests/sndrcv_tls_client_missing_cert.sh +@@ -1,6 +1,9 @@ + #!/bin/bash + # This file is part of the rsyslog project, released under ASL 2.0 + . ${srcdir:=.}/diag.sh init ++echo "This test is under review - it seems to have some issues" ++exit 77 ++ + printf 'using TLS driver: %s\n' ${RS_TLS_DRIVER:=gtls} + + # start up the instances +diff --git a/threads.c b/threads.c +index 2fd4bbb86c..95e85c1926 100644 +--- a/threads.c ++++ b/threads.c +@@ -302,7 +302,7 @@ rsRetVal thrdCreate(rsRetVal (*thrdMain)(thrdInfo_t*), rsRetVal(*afterRun)(thrdI + rsRetVal thrdInit(void) + { + DEFiRet; +- iRet = llInit(&llThrds, thrdDestruct, NULL, NULL); ++ iRet = llInit(&llThrds, (rsRetVal (*)(void*)) thrdDestruct, NULL, NULL); + RETiRet; + } + +diff --git a/tools/iminternal.c b/tools/iminternal.c +index c4dd548cee..105cf9f903 100644 +--- a/tools/iminternal.c ++++ b/tools/iminternal.c +@@ -163,7 +163,7 @@ rsRetVal iminternalRemoveMsg(smsg_t **ppMsg) + rsRetVal modInitIminternal(void) + { + DEFiRet; +- iRet = llInit(&llMsgs, iminternalDestruct, NULL, NULL); ++ iRet = llInit(&llMsgs, (rsRetVal (*)(void*)) iminternalDestruct, NULL, NULL); + RETiRet; + } + diff --git a/rsyslog.spec b/rsyslog.spec index 333a978..c9e2679 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2412.0 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -70,6 +70,7 @@ BuildRequires: zlib-devel BuildRequires: libcap-ng-devel Patch0: disable-openssl-engine.patch +Patch1: gnu23.patch Recommends: logrotate Obsoletes: rsyslog-logrotate < 8.2310.0-2 @@ -382,6 +383,7 @@ mv build doc # set up rsyslog sources %setup -q -D %patch -P 0 -p1 +%patch -P 1 -p1 %if %{with omamqp1} # Unpack qpid-proton @@ -762,6 +764,9 @@ done %changelog +* Tue Jan 21 2025 Attila Lakatos - 8.2412.0-3 +- Fix build problem by resolving -Wincompatible-pointer-types error + * Sat Jan 18 2025 Fedora Release Engineering - 8.2412.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 8a0d7614d65ace0b23c8c6937daaeb1402b5b4bd Mon Sep 17 00:00:00 2001 From: Attila Lakatos Date: Thu, 12 Jun 2025 08:13:47 +0200 Subject: [PATCH 34/41] Rebase to 8.2506.0V Resolves: rhbz#2347628 --- .gitignore | 2 + disable-openssl-engine.patch | 60 ------ gnu23.patch | 354 ----------------------------------- rsyslog.spec | 15 +- sources | 4 +- 5 files changed, 11 insertions(+), 424 deletions(-) delete mode 100644 disable-openssl-engine.patch delete mode 100644 gnu23.patch diff --git a/.gitignore b/.gitignore index ff0224a..b2767df 100644 --- a/.gitignore +++ b/.gitignore @@ -98,3 +98,5 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2408.0.tar.gz /rsyslog-8.2412.0.tar.gz /rsyslog-doc-8.2412.0.tar.gz +/rsyslog-8.2506.0.tar.gz +/rsyslog-doc-8.2506.0.tar.gz diff --git a/disable-openssl-engine.patch b/disable-openssl-engine.patch deleted file mode 100644 index 20ba01e..0000000 --- a/disable-openssl-engine.patch +++ /dev/null @@ -1,60 +0,0 @@ -diff -up rsyslog-8.2412.0/runtime/net_ossl.c.orig rsyslog-8.2412.0/runtime/net_ossl.c ---- rsyslog-8.2412.0/runtime/net_ossl.c.orig 2024-11-27 13:05:51.327988286 +0100 -+++ rsyslog-8.2412.0/runtime/net_ossl.c 2024-11-27 13:06:26.806335104 +0100 -@@ -220,6 +220,7 @@ osslGlblInit(void) - ERR_load_crypto_strings(); - #endif - -+#ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM - PRAGMA_DIAGNOSTIC_PUSH - PRAGMA_IGNORE_Wdeprecated_declarations - -@@ -244,6 +245,8 @@ PRAGMA_IGNORE_Wdeprecated_declarations - // Free the engine reference when done - ENGINE_free(osslEngine); - PRAGMA_DIAGNOSTIC_POP -+#endif -+ - } - - /* globally de-initialize OpenSSL */ -@@ -251,7 +254,9 @@ void - osslGlblExit(void) - { - DBGPRINTF("openssl: entering osslGlblExit\n"); -+ #ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM - ENGINE_cleanup(); -+ #endif - ERR_free_strings(); - EVP_cleanup(); - CRYPTO_cleanup_all_ex_data(); -@@ -1149,6 +1154,7 @@ net_ossl_init_engine(__attribute__((unus - const char *engine_id = NULL; - const char *engine_name = NULL; - -+#ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM - PRAGMA_DIAGNOSTIC_PUSH - PRAGMA_IGNORE_Wdeprecated_declarations - // Get the default RSA engine -@@ -1189,7 +1195,7 @@ PRAGMA_IGNORE_Wdeprecated_declarations - DBGPRINTF("net_ossl_init_engine: use openssl default Engine"); - } - PRAGMA_DIAGNOSTIC_POP -- -+#endif // ENABLE_OPENSSL_ENGINES_DOWNSTREAM - RETiRet; - } - -diff -up rsyslog-8.2412.0/runtime/net_ossl.h.orig rsyslog-8.2412.0/runtime/net_ossl.h ---- rsyslog-8.2412.0/runtime/net_ossl.h.orig 2024-11-27 13:06:01.138084180 +0100 -+++ rsyslog-8.2412.0/runtime/net_ossl.h 2024-11-27 13:06:30.536372456 +0100 -@@ -31,7 +31,9 @@ - #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) - # include - #endif -+#ifdef ENABLE_OPENSSL_ENGINES_DOWNSTREAM - #include -+#endif - #include - #include - diff --git a/gnu23.patch b/gnu23.patch deleted file mode 100644 index d671459..0000000 --- a/gnu23.patch +++ /dev/null @@ -1,354 +0,0 @@ -diff --git a/runtime/cfsysline.c b/runtime/cfsysline.c -index 06fdb4bb05..a9ba2684ec 100644 ---- a/runtime/cfsysline.c -+++ b/runtime/cfsysline.c -@@ -723,46 +723,46 @@ int *permitted) - static rsRetVal cslchCallHdlr(cslCmdHdlr_t *pThis, uchar **ppConfLine) - { - DEFiRet; -- rsRetVal (*pHdlr)() = NULL; -+ rsRetVal (*pHdlr)(void *, ...) = NULL; - assert(pThis != NULL); - assert(ppConfLine != NULL); - - switch(pThis->eType) { - case eCmdHdlrCustomHandler: -- pHdlr = doCustomHdlr; -+ pHdlr = (rsRetVal (*)(void *, ...)) doCustomHdlr; - break; - case eCmdHdlrUID: -- pHdlr = doGetUID; -+ pHdlr = (rsRetVal (*)(void *, ...)) doGetUID; - break; - case eCmdHdlrGID: -- pHdlr = doGetGID; -+ pHdlr = (rsRetVal (*)(void *, ...)) doGetGID; - break; - case eCmdHdlrBinary: -- pHdlr = doBinaryOptionLine; -+ pHdlr = (rsRetVal (*)(void *, ...)) doBinaryOptionLine; - break; - case eCmdHdlrFileCreateMode: -- pHdlr = doFileCreateMode; -+ pHdlr = (rsRetVal (*)(void *, ...)) doFileCreateMode; - break; - case eCmdHdlrInt: -- pHdlr = doGetInt; -+ pHdlr = (rsRetVal (*)(void *, ...)) doGetInt; - break; - case eCmdHdlrSize: -- pHdlr = doGetSize; -+ pHdlr = (rsRetVal (*)(void *, ...)) doGetSize; - break; - case eCmdHdlrGetChar: -- pHdlr = doGetChar; -+ pHdlr = (rsRetVal (*)(void *, ...)) doGetChar; - break; - case eCmdHdlrFacility: -- pHdlr = doFacility; -+ pHdlr = (rsRetVal (*)(void *, ...)) doFacility; - break; - case eCmdHdlrSeverity: -- pHdlr = doSeverity; -+ pHdlr = (rsRetVal (*)(void *, ...)) doSeverity; - break; - case eCmdHdlrGetWord: -- pHdlr = doGetWord; -+ pHdlr = (rsRetVal (*)(void *, ...)) doGetWord; - break; - case eCmdHdlrGoneAway: -- pHdlr = doGoneAway; -+ pHdlr = (rsRetVal (*)(void *, ...)) doGoneAway; - break; - /* some non-legacy handler (used in v6+ solely) */ - case eCmdHdlrInvalid: -@@ -827,7 +827,7 @@ static rsRetVal cslcConstruct(cslCmd_t **ppThis, int bChainingPermitted) - - pThis->bChainingPermitted = bChainingPermitted; - -- CHKiRet(llInit(&pThis->llCmdHdlrs, cslchDestruct, cslchKeyDestruct, cslchKeyCompare)); -+ CHKiRet(llInit(&pThis->llCmdHdlrs, cslchDestruct, cslchKeyDestruct, (int (*) (void*, void*)) cslchKeyCompare)); - - finalize_it: - *ppThis = pThis; -@@ -1074,7 +1074,7 @@ cfsyslineInit(void) - DEFiRet; - CHKiRet(objGetObjInterface(&obj)); - -- CHKiRet(llInit(&llCmdList, cslcDestruct, cslcKeyDestruct, strcasecmp)); -+ CHKiRet(llInit(&llCmdList, cslcDestruct, cslcKeyDestruct, (int (*)(void*, void*)) strcasecmp)); - - finalize_it: - RETiRet; -diff --git a/runtime/linkedlist.c b/runtime/linkedlist.c -index 70887379b2..499629399b 100644 ---- a/runtime/linkedlist.c -+++ b/runtime/linkedlist.c -@@ -43,7 +43,7 @@ - * pKey destructor may be zero to take care of non-keyed lists. - */ - rsRetVal llInit(linkedList_t *pThis, rsRetVal (*pEltDestructor)(void*), rsRetVal (*pKeyDestructor)(void*), --int (*pCmpOp)(void*,void*)) -+ int (*pCmpOp)(void*,void*)) - { - assert(pThis != NULL); - assert(pEltDestructor != NULL); -diff --git a/runtime/linkedlist.h b/runtime/linkedlist.h -index 1cd3a143f2..9894541889 100644 ---- a/runtime/linkedlist.h -+++ b/runtime/linkedlist.h -@@ -52,7 +52,8 @@ typedef struct linkedList_s linkedList_t; - typedef llElt_t* linkedListCookie_t; /* this type avoids exposing internals and keeps us flexible */ - - /* prototypes */ --rsRetVal llInit(linkedList_t *pThis, rsRetVal (*pEltDestructor)(), rsRetVal (*pKeyDestructor)(), int (*pCmpOp)()); -+rsRetVal llInit(linkedList_t *pThis, rsRetVal (*pEltDestructor)(void*), -+ rsRetVal (*pKeyDestructor)(void*), int (*pCmpOp)(void*,void*)); - rsRetVal llDestroy(linkedList_t *pThis); - rsRetVal llDestroyRootElt(linkedList_t *pThis); - rsRetVal llGetNextElt(linkedList_t *pThis, linkedListCookie_t *ppElt, void **ppUsr); -diff --git a/runtime/obj-types.h b/runtime/obj-types.h -index 21fb89bbe1..b708d6fc9e 100644 ---- a/runtime/obj-types.h -+++ b/runtime/obj-types.h -@@ -5,7 +5,7 @@ - * that loop somehow and I've done that by moving the typedefs - * into this file here. - * -- * Copyright 2008-2019 Rainer Gerhards and Adiscon GmbH. -+ * Copyright 2008-2024 Rainer Gerhards and Adiscon GmbH. - * - * This file is part of the rsyslog runtime library. - * -@@ -74,7 +74,7 @@ struct objInfo_s { - size_t lenID; /* length of the ID string */ - int iObjVers; - uchar *pszName; -- rsRetVal (*objMethods[OBJ_NUM_METHODS])(); -+ rsRetVal (*objMethods[OBJ_NUM_METHODS])(void*, ...); - rsRetVal (*QueryIF)(interface_t*); - struct modInfo_s *pModInfo; - }; -diff --git a/runtime/obj.c b/runtime/obj.c -index 03a56f7a3a..4fa39772f0 100644 ---- a/runtime/obj.c -+++ b/runtime/obj.c -@@ -48,7 +48,7 @@ - * - * File begun on 2008-01-04 by RGerhards - * -- * Copyright 2008-2019 Rainer Gerhards and Adiscon GmbH. -+ * Copyright 2008-2024 Rainer Gerhards and Adiscon GmbH. - * - * This file is part of the rsyslog runtime library. - * -@@ -125,7 +125,7 @@ static rsRetVal objInfoNotImplementedDummy(void __attribute__((unused)) *pThis) - * must be provided an objInfo_t pointer. - */ - #define objInfoIsImplemented(pThis, method) \ -- (pThis->objMethods[method] != objInfoNotImplementedDummy) -+ (pThis->objMethods[method] != (rsRetVal (*)(void *, ...)) objInfoNotImplementedDummy) - - /* construct an object Info object. Each class shall do this on init. The - * resulting object shall be cached during the lifetime of the class and each -@@ -154,10 +154,10 @@ InfoConstruct(objInfo_t **ppThis, uchar *pszID, int iObjVers, - pThis->QueryIF = pQueryIF; - pThis->pModInfo = pModInfo; - -- pThis->objMethods[0] = pConstruct; -- pThis->objMethods[1] = pDestruct; -+ pThis->objMethods[0] = (rsRetVal (*)(void *, ...)) pConstruct; -+ pThis->objMethods[1] = (rsRetVal (*)(void *, ...)) pDestruct; - for(i = 2 ; i < OBJ_NUM_METHODS ; ++i) { -- pThis->objMethods[i] = objInfoNotImplementedDummy; -+ pThis->objMethods[i] = (rsRetVal (*)(void *, ...)) objInfoNotImplementedDummy; - } - - *ppThis = pThis; -@@ -192,7 +192,7 @@ InfoDestruct(objInfo_t **ppThis) - static rsRetVal - InfoSetMethod(objInfo_t *pThis, objMethod_t objMethod, rsRetVal (*pHandler)(void*)) - { -- pThis->objMethods[objMethod] = pHandler; -+ pThis->objMethods[objMethod] = (rsRetVal (*)(void *, ...)) pHandler; - return RS_RET_OK; - } - -@@ -786,7 +786,7 @@ static rsRetVal objDeserializeTryRecover(strm_t *pStrm) - * of the trailer. Header must already have been processed. - * rgerhards, 2008-01-11 - */ --static rsRetVal objDeserializeProperties(obj_t *pObj, rsRetVal (*objSetProperty)(), strm_t *pStrm) -+static rsRetVal objDeserializeProperties(obj_t *pObj, rsRetVal (*objSetProperty)(void*, ...), strm_t *pStrm) - { - DEFiRet; - var_t *pVar = NULL; -@@ -867,7 +867,8 @@ Deserialize(void *ppObj, uchar *pszTypeExpected, strm_t *pStrm, rsRetVal (*fFixu - CHKiRet(pObjInfo->objMethods[objMethod_CONSTRUCT](&pObj)); - - /* we got the object, now we need to fill the properties */ -- CHKiRet(objDeserializeProperties(pObj, pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); -+ CHKiRet(objDeserializeProperties(pObj, -+ (rsRetVal (*)(void*, ...)) pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); - - /* check if we need to call a fixup function that modifies the object - * before it is finalized. -- rgerhards, 2008-01-13 -@@ -898,8 +899,10 @@ Deserialize(void *ppObj, uchar *pszTypeExpected, strm_t *pStrm, rsRetVal (*fFixu - */ - rsRetVal - objDeserializeWithMethods(void *ppObj, uchar *pszTypeExpected, int lenTypeExpected, strm_t *pStrm, --rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, rsRetVal (*objConstruct)(), rsRetVal (*objConstructFinalize)(), --rsRetVal (*objDeserialize)()) -+ rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, -+ rsRetVal (*objConstruct)(void *, ...), -+ rsRetVal (*objConstructFinalize)(void *, ...), -+ rsRetVal (*objDeserialize)(void *, ...)) - { - DEFiRet; - rsRetVal iRetLocal; -@@ -1007,7 +1010,8 @@ DeserializePropBag(obj_t *pObj, strm_t *pStrm) - CHKiRet(FindObjInfo((char*)cstrGetSzStrNoNULL(pstrID), &pObjInfo)); - - /* we got the object, now we need to fill the properties */ -- CHKiRet(objDeserializeProperties(pObj, pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); -+ CHKiRet(objDeserializeProperties(pObj, -+ (rsRetVal (*)(void*, ...)) pObjInfo->objMethods[objMethod_SETPROPERTY], pStrm)); - - finalize_it: - if(pstrID != NULL) -diff --git a/runtime/obj.h b/runtime/obj.h -index 0efe6e7081..455cb873f5 100644 ---- a/runtime/obj.h -+++ b/runtime/obj.h -@@ -21,7 +21,7 @@ - * - * pThis always references to a pointer of the object. - * -- * Copyright 2008-2018 Adiscon GmbH. -+ * Copyright 2008-2024 Adiscon GmbH. - * - * This file is part of the rsyslog runtime library. - * -@@ -119,9 +119,12 @@ ENDinterface(obj) - rsRetVal objGetObjInterface(obj_if_t *pIf); - PROTOTYPEObjClassInit(obj); - PROTOTYPEObjClassExit(obj); --rsRetVal objDeserializeWithMethods(void *ppObj, uchar *pszTypeExpected, int lenTypeExpected, strm_t *pStrm, --rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, rsRetVal (*objConstruct)(), rsRetVal (*objConstructFinalize)(), --rsRetVal (*objDeserialize)()); -+rsRetVal -+objDeserializeWithMethods(void *ppObj, uchar *pszTypeExpected, int lenTypeExpected, strm_t *pStrm, -+ rsRetVal (*fFixup)(obj_t*,void*), void *pUsr, -+ rsRetVal (*objConstruct)(void *, ...), -+ rsRetVal (*objConstructFinalize)(void *, ...), -+ rsRetVal (*objDeserialize)(void*, ...)); - rsRetVal objDeserializeProperty(var_t *pProp, strm_t *pStrm); - uchar *objGetName(obj_t *pThis); - -diff --git a/runtime/queue.c b/runtime/queue.c -index edc9d3513b..e17da6d7c3 100644 ---- a/runtime/queue.c -+++ b/runtime/queue.c -@@ -1063,7 +1063,8 @@ qDeqDisk(qqueue_t *pThis, smsg_t **ppMsg) - DEFiRet; - iRet = objDeserializeWithMethods(ppMsg, (uchar*) "msg", 3, - pThis->tVars.disk.pReadDeq, NULL, -- NULL, msgConstructForDeserializer, NULL, MsgDeserialize); -+ NULL, (rsRetVal (*)(void *, ...)) msgConstructForDeserializer, NULL, -+ (rsRetVal (*)(void *, ...)) MsgDeserialize); - if(iRet != RS_RET_OK) { - LogError(0, iRet, "%s: qDeqDisk error happened at around offset %lld", - obj.GetName((obj_t*)pThis), -diff --git a/runtime/rsconf.c b/runtime/rsconf.c -index 71b31be3cd..a0d735d423 100644 ---- a/runtime/rsconf.c -+++ b/runtime/rsconf.c -@@ -290,7 +290,7 @@ BEGINobjConstruct(rsconf) /* be sure to specify the object type also in END macr - CHKiRet(dynstats_initCnf(&pThis->dynstats_buckets)); - CHKiRet(perctile_initCnf(&pThis->perctile_buckets)); - CHKiRet(llInit(&pThis->rulesets.llRulesets, rulesetDestructForLinkedList, -- rulesetKeyDestruct, strcasecmp)); -+ rulesetKeyDestruct, (int (*)(void*, void*)) strcasecmp)); - finalize_it: - ENDobjConstruct(rsconf) - -diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h -index 94b6605e8b..f98a5db3c7 100644 ---- a/runtime/rsyslog.h -+++ b/runtime/rsyslog.h -@@ -52,7 +52,9 @@ - * being emitted where nobody knows what the mean and why they appear :-( - */ - #pragma GCC diagnostic ignored "-Wjump-misses-init" -- #endif /* if __GNUC__ >= 8 */ -+ #pragma GCC diagnostic ignored "-Wincompatible-pointer-types" -+ #pragma GCC diagnostic ignored "-Wcast-function-type" -+ #endif - - #if defined(__clang__) - #define ATTR_NO_SANITIZE_UNDEFINED __attribute__((no_sanitize("undefined"))) -diff --git a/runtime/ruleset.c b/runtime/ruleset.c -index c137ee3b01..228283c28c 100644 ---- a/runtime/ruleset.c -+++ b/runtime/ruleset.c -@@ -888,7 +888,7 @@ destructAllActions(rsconf_t *conf) - - CHKiRet(llDestroy(&(conf->rulesets.llRulesets))); - CHKiRet(llInit(&(conf->rulesets.llRulesets), rulesetDestructForLinkedList, -- rulesetKeyDestruct, strcasecmp)); -+ rulesetKeyDestruct, (int (*)(void*, void*)) strcasecmp)); - conf->rulesets.pDflt = NULL; - - finalize_it: -diff --git a/tests/sndrcv_tls_anon_rebind.sh b/tests/sndrcv_tls_anon_rebind.sh -index dcd1e6e985..e3ae592a10 100755 ---- a/tests/sndrcv_tls_anon_rebind.sh -+++ b/tests/sndrcv_tls_anon_rebind.sh -@@ -3,6 +3,7 @@ - # rgerhards, 2011-04-04 - # This file is part of the rsyslog project, released under GPLv3 - . ${srcdir:=.}/diag.sh init -+skip_platform "SunOS" "Test fails with environment-induced errors, which we cannot solve" - - export NUMMESSAGES=25000 #25000 - -diff --git a/tests/sndrcv_tls_client_missing_cert.sh b/tests/sndrcv_tls_client_missing_cert.sh -index aa0c320244..c0c651706d 100755 ---- a/tests/sndrcv_tls_client_missing_cert.sh -+++ b/tests/sndrcv_tls_client_missing_cert.sh -@@ -1,6 +1,9 @@ - #!/bin/bash - # This file is part of the rsyslog project, released under ASL 2.0 - . ${srcdir:=.}/diag.sh init -+echo "This test is under review - it seems to have some issues" -+exit 77 -+ - printf 'using TLS driver: %s\n' ${RS_TLS_DRIVER:=gtls} - - # start up the instances -diff --git a/threads.c b/threads.c -index 2fd4bbb86c..95e85c1926 100644 ---- a/threads.c -+++ b/threads.c -@@ -302,7 +302,7 @@ rsRetVal thrdCreate(rsRetVal (*thrdMain)(thrdInfo_t*), rsRetVal(*afterRun)(thrdI - rsRetVal thrdInit(void) - { - DEFiRet; -- iRet = llInit(&llThrds, thrdDestruct, NULL, NULL); -+ iRet = llInit(&llThrds, (rsRetVal (*)(void*)) thrdDestruct, NULL, NULL); - RETiRet; - } - -diff --git a/tools/iminternal.c b/tools/iminternal.c -index c4dd548cee..105cf9f903 100644 ---- a/tools/iminternal.c -+++ b/tools/iminternal.c -@@ -163,7 +163,7 @@ rsRetVal iminternalRemoveMsg(smsg_t **ppMsg) - rsRetVal modInitIminternal(void) - { - DEFiRet; -- iRet = llInit(&llMsgs, iminternalDestruct, NULL, NULL); -+ iRet = llInit(&llMsgs, (rsRetVal (*)(void*)) iminternalDestruct, NULL, NULL); - RETiRet; - } - diff --git a/rsyslog.spec b/rsyslog.spec index c9e2679..1e8de05 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -36,8 +36,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2412.0 -Release: 3%{?dist} +Version: 8.2506.0 +Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -69,9 +69,6 @@ BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel BuildRequires: libcap-ng-devel -Patch0: disable-openssl-engine.patch -Patch1: gnu23.patch - Recommends: logrotate Obsoletes: rsyslog-logrotate < 8.2310.0-2 Provides: rsyslog-logrotate = %{version}-%{release} @@ -382,8 +379,6 @@ rm -r LICENSE README.md source build/objects.inv mv build doc # set up rsyslog sources %setup -q -D -%patch -P 0 -p1 -%patch -P 1 -p1 %if %{with omamqp1} # Unpack qpid-proton @@ -764,6 +759,10 @@ done %changelog +* Thu Jun 12 2025 Attila Lakatos - 8.2506.0-1 +- Rebase to 8.2506.0 + Resolves: rhbz#2347628 + * Tue Jan 21 2025 Attila Lakatos - 8.2412.0-3 - Fix build problem by resolving -Wincompatible-pointer-types error @@ -778,7 +777,7 @@ done * Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 - Rebuild package - Resolves: rhzb#2316361 + Resolves: rhbz#2316361 * Wed Aug 21 2024 Attila Lakatos - 8.2408.0-1 - Rebase to 8.2408.0 diff --git a/sources b/sources index 380a910..7e05396 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b -SHA512 (rsyslog-8.2412.0.tar.gz) = fdd8bb096c9578fe2c4ed8cdb13179d7b3333d0f9be1b2c921b5b040f1e1414c3f9f8106e44444aaefba22f235a44d17c0c5b80cd114fe540a2aebb30e3eba72 -SHA512 (rsyslog-doc-8.2412.0.tar.gz) = 9b5d453b5774b027a6a4ba232133953d8a8058df4bfff31f835504656d7b01008cec5c0d28667bed0052799cf7389c0bafea7c76c3190bdcdf3d8a2eedf19b4e +SHA512 (rsyslog-8.2506.0.tar.gz) = 82fd3a3e76217081c7903b0bdb8bdb46c23657593d84d5ff7f836efca4c76d7d2870706150a6473c0667f0c8571a3c8e5d237619a3ad3940701925efaec32941 +SHA512 (rsyslog-doc-8.2506.0.tar.gz) = 49db24f5905e4c48ab198358a646d105d0b10c23c7b9ea27d26baa533506e21420829a62acf52f4d34b56250d30988c1f8ab2d6798b3a416b0692c1fcf3c538d From 6e2902bbf53ddc56069650ea82bac560d246afd5 Mon Sep 17 00:00:00 2001 From: Attila Lakatos Date: Thu, 12 Jun 2025 08:53:31 +0200 Subject: [PATCH 35/41] Fix building without openssl engines --- openssl-engines-disable.patch | 62 +++++++++++++++++++++++++++++++++++ rsyslog.spec | 3 ++ 2 files changed, 65 insertions(+) create mode 100644 openssl-engines-disable.patch diff --git a/openssl-engines-disable.patch b/openssl-engines-disable.patch new file mode 100644 index 0000000..877f0a4 --- /dev/null +++ b/openssl-engines-disable.patch @@ -0,0 +1,62 @@ +diff --git a/plugins/imdtls/imdtls.c b/plugins/imdtls/imdtls.c +index f90e8ad61c..bfb63452c7 100644 +--- a/plugins/imdtls/imdtls.c ++++ b/plugins/imdtls/imdtls.c +@@ -41,7 +41,9 @@ + #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) + # include + #endif +-#include ++#ifndef OPENSSL_NO_ENGINE ++# include ++#endif + // --- + + #include "rsyslog.h" +diff --git a/plugins/omdtls/omdtls.c b/plugins/omdtls/omdtls.c +index 2b28908030..693ff99c77 100644 +--- a/plugins/omdtls/omdtls.c ++++ b/plugins/omdtls/omdtls.c +@@ -52,7 +52,9 @@ + #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) + # include + #endif +-#include ++#ifndef OPENSSL_NO_ENGINE ++# include ++#endif + // --- + + // Include rsyslog headers +diff --git a/runtime/net_ossl.h b/runtime/net_ossl.h +index af36ffe488..d66a422d4d 100644 +--- a/runtime/net_ossl.h ++++ b/runtime/net_ossl.h +@@ -31,7 +31,9 @@ + #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) + # include + #endif +-#include ++#ifndef OPENSSL_NO_ENGINE ++# include ++#endif + #include + #include + +diff --git a/tests/tcpflood.c b/tests/tcpflood.c +index 4b2d98b2c8..7322aeb135 100644 +--- a/tests/tcpflood.c ++++ b/tests/tcpflood.c +@@ -129,8 +129,10 @@ + #ifdef ENABLE_OPENSSL + #include + #include +- #include +- #include ++ #include ++# ifndef OPENSSL_NO_ENGINE ++# include ++# endif + + /* OpenSSL API differences */ + #if OPENSSL_VERSION_NUMBER >= 0x10100000L diff --git a/rsyslog.spec b/rsyslog.spec index 1e8de05..429269e 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -69,6 +69,8 @@ BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel BuildRequires: libcap-ng-devel +Patch0: openssl-engines-disable.patch + Recommends: logrotate Obsoletes: rsyslog-logrotate < 8.2310.0-2 Provides: rsyslog-logrotate = %{version}-%{release} @@ -379,6 +381,7 @@ rm -r LICENSE README.md source build/objects.inv mv build doc # set up rsyslog sources %setup -q -D +%patch -P 0 -p1 %if %{with omamqp1} # Unpack qpid-proton From 752b97d2f5fd211e9649ce834772f70a4abc5e53 Mon Sep 17 00:00:00 2001 From: Attila Lakatos Date: Thu, 12 Jun 2025 09:16:25 +0200 Subject: [PATCH 36/41] Add back accidentally removed patch --- rsyslog.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rsyslog.spec b/rsyslog.spec index 429269e..f3841a8 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -70,6 +70,7 @@ BuildRequires: zlib-devel BuildRequires: libcap-ng-devel Patch0: openssl-engines-disable.patch +Patch1: openssl3-compatibility.patch Recommends: logrotate Obsoletes: rsyslog-logrotate < 8.2310.0-2 @@ -382,6 +383,7 @@ mv build doc # set up rsyslog sources %setup -q -D %patch -P 0 -p1 +%patch -P 1 -p1 %if %{with omamqp1} # Unpack qpid-proton From 848f0a11426187fa3d557be0b3798bb2b34e3a4c Mon Sep 17 00:00:00 2001 From: Attila Lakatos Date: Thu, 12 Jun 2025 10:41:42 +0200 Subject: [PATCH 37/41] Fix broken omamqp1 module build --- rsyslog.spec | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/rsyslog.spec b/rsyslog.spec index f3841a8..9716008 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -70,7 +70,6 @@ BuildRequires: zlib-devel BuildRequires: libcap-ng-devel Patch0: openssl-engines-disable.patch -Patch1: openssl3-compatibility.patch Recommends: logrotate Obsoletes: rsyslog-logrotate < 8.2310.0-2 @@ -383,7 +382,6 @@ mv build doc # set up rsyslog sources %setup -q -D %patch -P 0 -p1 -%patch -P 1 -p1 %if %{with omamqp1} # Unpack qpid-proton @@ -406,14 +404,13 @@ export CFLAGS="$RPM_OPT_FLAGS -fpic" cd bld # Need ENABLE_FUZZ_TESTING=NO to avoid a link failure - # Find python include dir and python library from - # https://stackoverflow.com/questions/24174394/cmake-is-not-able-to-find-python-libraries + # Modern approach for Python discovery in CMake cmake .. \ -DBUILD_BINDINGS="" \ -DBUILD_STATIC_LIBS=YES \ -DENABLE_FUZZ_TESTING=NO \ - -DPYTHON_INCLUDE_DIR=$(python3 -c "from distutils.sysconfig import get_python_inc; print(get_python_inc())") \ - -DPYTHON_LIBRARY=$(python3 -c "import distutils.sysconfig as sysconfig; print(sysconfig.get_config_var('LIBDIR'))") \ + -DPython_FIND_STRATEGY=LOCATION \ + -DPython_ROOT_DIR=/usr \ -DCMAKE_AR="/usr/bin/gcc-ar" -DCMAKE_NM="/usr/bin/gcc-nm" -DCMAKE_RANLIB="/usr/bin/gcc-ranlib" make -j8 ) @@ -463,7 +460,7 @@ autoreconf -if --enable-omrabbitmq \ %endif %if %{with omamqp1} - --enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ + --enable-omamqp1 PROTON_PROACTOR_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_PROACTOR_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ %endif --enable-elasticsearch \ --enable-generate-man-pages \ From 06ff53b9e1ad1ec760b5da2c2355b3f0b6cdccd0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 12:09:59 +0000 Subject: [PATCH 38/41] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- rsyslog.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 9716008..1d14574 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -37,7 +37,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2506.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -761,6 +761,9 @@ done %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 8.2506.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Jun 12 2025 Attila Lakatos - 8.2506.0-1 - Rebase to 8.2506.0 Resolves: rhbz#2347628 From 8770ba82dff70550a2db8959ac6eb7850695f322 Mon Sep 17 00:00:00 2001 From: Attila Lakatos Date: Fri, 5 Sep 2025 08:25:56 +0200 Subject: [PATCH 39/41] Rebase to 8.2508.0 Resolves: rhbz#2392918 --- .gitignore | 2 + openssl-engines-disable.patch | 62 -------------------------- openssl3-compatibility.patch | 83 ----------------------------------- rsyslog.spec | 43 +++++++++--------- sources | 5 +-- 5 files changed, 24 insertions(+), 171 deletions(-) delete mode 100644 openssl-engines-disable.patch delete mode 100644 openssl3-compatibility.patch diff --git a/.gitignore b/.gitignore index b2767df..54d79dc 100644 --- a/.gitignore +++ b/.gitignore @@ -100,3 +100,5 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2412.0.tar.gz /rsyslog-8.2506.0.tar.gz /rsyslog-doc-8.2506.0.tar.gz +/rsyslog-8.2508.0.tar.gz +/qpid-proton-0.40.0.tar.gz diff --git a/openssl-engines-disable.patch b/openssl-engines-disable.patch deleted file mode 100644 index 877f0a4..0000000 --- a/openssl-engines-disable.patch +++ /dev/null @@ -1,62 +0,0 @@ -diff --git a/plugins/imdtls/imdtls.c b/plugins/imdtls/imdtls.c -index f90e8ad61c..bfb63452c7 100644 ---- a/plugins/imdtls/imdtls.c -+++ b/plugins/imdtls/imdtls.c -@@ -41,7 +41,9 @@ - #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) - # include - #endif --#include -+#ifndef OPENSSL_NO_ENGINE -+# include -+#endif - // --- - - #include "rsyslog.h" -diff --git a/plugins/omdtls/omdtls.c b/plugins/omdtls/omdtls.c -index 2b28908030..693ff99c77 100644 ---- a/plugins/omdtls/omdtls.c -+++ b/plugins/omdtls/omdtls.c -@@ -52,7 +52,9 @@ - #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) - # include - #endif --#include -+#ifndef OPENSSL_NO_ENGINE -+# include -+#endif - // --- - - // Include rsyslog headers -diff --git a/runtime/net_ossl.h b/runtime/net_ossl.h -index af36ffe488..d66a422d4d 100644 ---- a/runtime/net_ossl.h -+++ b/runtime/net_ossl.h -@@ -31,7 +31,9 @@ - #if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER) - # include - #endif --#include -+#ifndef OPENSSL_NO_ENGINE -+# include -+#endif - #include - #include - -diff --git a/tests/tcpflood.c b/tests/tcpflood.c -index 4b2d98b2c8..7322aeb135 100644 ---- a/tests/tcpflood.c -+++ b/tests/tcpflood.c -@@ -129,8 +129,10 @@ - #ifdef ENABLE_OPENSSL - #include - #include -- #include -- #include -+ #include -+# ifndef OPENSSL_NO_ENGINE -+# include -+# endif - - /* OpenSSL API differences */ - #if OPENSSL_VERSION_NUMBER >= 0x10100000L diff --git a/openssl3-compatibility.patch b/openssl3-compatibility.patch deleted file mode 100644 index c86fe23..0000000 --- a/openssl3-compatibility.patch +++ /dev/null @@ -1,83 +0,0 @@ -diff -up ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig ./qpid-proton-0.34.0/c/src/ssl/openssl.c ---- ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig 2021-06-01 09:29:27.976842727 +0200 -+++ ./qpid-proton-0.34.0/c/src/ssl/openssl.c 2021-06-01 09:31:05.232015887 +0200 -@@ -353,65 +353,6 @@ static int verify_callback(int preverify - return preverify_ok; - } - --// This was introduced in v1.1 --#if OPENSSL_VERSION_NUMBER < 0x10100000 --int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) --{ -- dh->p = p; -- dh->q = q; -- dh->g = g; -- return 1; --} --#endif -- --// this code was generated using the command: --// "openssl dhparam -C -2 2048" --static DH *get_dh2048(void) --{ -- static const unsigned char dhp_2048[]={ -- 0xAE,0xF7,0xE9,0x66,0x26,0x7A,0xAC,0x0A,0x6F,0x1E,0xCD,0x81, -- 0xBD,0x0A,0x10,0x7E,0xFA,0x2C,0xF5,0x2D,0x98,0xD4,0xE7,0xD9, -- 0xE4,0x04,0x8B,0x06,0x85,0xF2,0x0B,0xA3,0x90,0x15,0x56,0x0C, -- 0x8B,0xBE,0xF8,0x48,0xBB,0x29,0x63,0x75,0x12,0x48,0x9D,0x7E, -- 0x7C,0x24,0xB4,0x3A,0x38,0x7E,0x97,0x3C,0x77,0x95,0xB0,0xA2, -- 0x72,0xB6,0xE9,0xD8,0xB8,0xFA,0x09,0x1B,0xDC,0xB3,0x80,0x6E, -- 0x32,0x0A,0xDA,0xBB,0xE8,0x43,0x88,0x5B,0xAB,0xC3,0xB2,0x44, -- 0xE1,0x95,0x85,0x0A,0x0D,0x13,0xE2,0x02,0x1E,0x96,0x44,0xCF, -- 0xA0,0xD8,0x46,0x32,0x68,0x63,0x7F,0x68,0xB3,0x37,0x52,0xCE, -- 0x3A,0x4E,0x48,0x08,0x7F,0xD5,0x53,0x00,0x59,0xA8,0x2C,0xCB, -- 0x51,0x64,0x3D,0x5F,0xEF,0x0E,0x5F,0xE6,0xAF,0xD9,0x1E,0xA2, -- 0x35,0x64,0x37,0xD7,0x4C,0xC9,0x24,0xFD,0x2F,0x75,0xBB,0x3A, -- 0x15,0x82,0x76,0x4D,0xC2,0x8B,0x1E,0xB9,0x4B,0xA1,0x33,0xCF, -- 0xAA,0x3B,0x7C,0xC2,0x50,0x60,0x6F,0x45,0x69,0xD3,0x6B,0x88, -- 0x34,0x9B,0xE4,0xF8,0xC6,0xC7,0x5F,0x10,0xA1,0xBA,0x01,0x8C, -- 0xDA,0xD1,0xA3,0x59,0x9C,0x97,0xEA,0xC3,0xF6,0x02,0x55,0x5C, -- 0x92,0x1A,0x39,0x67,0x17,0xE2,0x9B,0x27,0x8D,0xE8,0x5C,0xE9, -- 0xA5,0x94,0xBB,0x7E,0x16,0x6F,0x53,0x5A,0x6D,0xD8,0x03,0xC2, -- 0xAC,0x7A,0xCD,0x22,0x98,0x8E,0x33,0x2A,0xDE,0xAB,0x12,0xC0, -- 0x0B,0x7C,0x0C,0x20,0x70,0xD9,0x0B,0xAE,0x0B,0x2F,0x20,0x9B, -- 0xA4,0xED,0xFD,0x49,0x0B,0xE3,0x4A,0xF6,0x28,0xB3,0x98,0xB0, -- 0x23,0x1C,0x09,0x33, -- }; -- static const unsigned char dhg_2048[]={ -- 0x02, -- }; -- DH *dh = DH_new(); -- BIGNUM *dhp_bn, *dhg_bn; -- -- if (dh == NULL) -- return NULL; -- dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL); -- dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL); -- if (dhp_bn == NULL || dhg_bn == NULL -- || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) { -- DH_free(dh); -- BN_free(dhp_bn); -- BN_free(dhg_bn); -- return NULL; -- } -- return dh; --} -- - typedef struct { - char *id; - SSL_SESSION *session; -@@ -542,13 +483,6 @@ static bool pni_init_ssl_domain( pn_ssl_ - domain->default_seclevel = SSL_CTX_get_security_level(domain->ctx); - # endif - -- DH *dh = get_dh2048(); -- if (dh) { -- SSL_CTX_set_tmp_dh(domain->ctx, dh); -- DH_free(dh); -- SSL_CTX_set_options(domain->ctx, SSL_OP_SINGLE_DH_USE); -- } -- - return true; - } - diff --git a/rsyslog.spec b/rsyslog.spec index 1d14574..051c0c4 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -1,7 +1,7 @@ %define rsyslog_statedir %{_sharedstatedir}/rsyslog %define rsyslog_pkidir %{_sysconfdir}/pki/rsyslog %define rsyslog_docdir %{_docdir}/rsyslog -%define qpid_proton_v 0.39.0 +%define qpid_proton_v 0.40.0 # The following packages are not enabled on rhel: # hiredis, libdbi, mongodb, rabbitmq # The omamqp1 plugin is built differently as qpid-proton is not available on rhel @@ -36,19 +36,18 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2506.0 -Release: 2%{?dist} +Version: 8.2508.0 +Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz -Source1: http://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{version}.tar.gz -Source2: rsyslog.conf -Source3: rsyslog.sysconfig -Source4: rsyslog.log -Source5: rsyslog.service +Source1: rsyslog.conf +Source2: rsyslog.sysconfig +Source3: rsyslog.log +Source4: rsyslog.service # Add qpid-proton as another source, enable omamqp1 module in a # separatae sub-package with it statically linked(see rhbz#1713427) -Source6: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz +Source5: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz BuildRequires: make BuildRequires: gcc @@ -69,8 +68,6 @@ BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel BuildRequires: libcap-ng-devel -Patch0: openssl-engines-disable.patch - Recommends: logrotate Obsoletes: rsyslog-logrotate < 8.2310.0-2 Provides: rsyslog-logrotate = %{version}-%{release} @@ -375,17 +372,12 @@ This module allows rsyslog to send messages to a RabbitMQ server. %endif %prep -# set up rsyslog-doc sources -%setup -q -a 1 -T -c -rm -r LICENSE README.md source build/objects.inv -mv build doc # set up rsyslog sources %setup -q -D -%patch -P 0 -p1 %if %{with omamqp1} # Unpack qpid-proton -%setup -q -D -T -b 6 +%setup -q -D -T -b 5 %endif %build @@ -541,10 +533,10 @@ install -d -m 700 %{buildroot}%{rsyslog_statedir} install -d -m 700 %{buildroot}%{rsyslog_pkidir} install -d -m 755 %{buildroot}%{rsyslog_docdir}/html -install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/rsyslog.conf -install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog -install -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog -install -p -m 644 %{SOURCE5} %{buildroot}%{_unitdir}/rsyslog.service +install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/rsyslog.conf +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog +install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog +install -p -m 644 %{SOURCE4} %{buildroot}%{_unitdir}/rsyslog.service %if %{with mysql} install -p -m 644 plugins/ommysql/createDB.sql %{buildroot}%{rsyslog_docdir}/mysql-createDB.sql @@ -583,8 +575,8 @@ done %{!?_licensedir:%global license %%doc} %license COPYING* %doc AUTHORS ChangeLog README.md -%{rsyslog_docdir} %exclude %{rsyslog_docdir}/html +%exclude %{rsyslog_docdir}/recover_qi.pl %if %{with mysql} %exclude %{rsyslog_docdir}/mysql-createDB.sql %endif @@ -652,7 +644,8 @@ done %{_libdir}/rsyslog/lmcry_ossl.so %files doc -%doc %{rsyslog_docdir}/html +%{rsyslog_docdir}/html +%{rsyslog_docdir}/recover_qi.pl %files elasticsearch %{_libdir}/rsyslog/omelasticsearch.so @@ -761,6 +754,10 @@ done %changelog +* Fri Sep 05 2025 Attila Lakatos - 8.2508.0-1 +- Rebase to 8.2508.0 + Resolves: rhbz#2392918 + * Fri Jul 25 2025 Fedora Release Engineering - 8.2506.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index 7e05396..e23ea0e 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b -SHA512 (rsyslog-8.2506.0.tar.gz) = 82fd3a3e76217081c7903b0bdb8bdb46c23657593d84d5ff7f836efca4c76d7d2870706150a6473c0667f0c8571a3c8e5d237619a3ad3940701925efaec32941 -SHA512 (rsyslog-doc-8.2506.0.tar.gz) = 49db24f5905e4c48ab198358a646d105d0b10c23c7b9ea27d26baa533506e21420829a62acf52f4d34b56250d30988c1f8ab2d6798b3a416b0692c1fcf3c538d +SHA512 (rsyslog-8.2508.0.tar.gz) = 73d9cfa9e3260aacefc20acd2f30db2d6ea01fb2d309cebcc81802a9d6d756e719810572f330931027b2d21a9fb57deaadb8bf9bd0849be6da5794ff6d178a0c +SHA512 (qpid-proton-0.40.0.tar.gz) = 3e7fe56ca1423f45f71d81f5e1d6ec5f21c073cc580628e12a8dbd545a86805b7312834e0d1234dde43797633d575ed639f21a96239b217500cc0a824482aae3 From deb76591493ecda7eb9f63d2fcb5821dc2e26de6 Mon Sep 17 00:00:00 2001 From: Attila Lakatos Date: Mon, 20 Oct 2025 09:25:46 +0200 Subject: [PATCH 40/41] Rebase to 8.2510.0 Resolves: rhbz#2404131 imjournal open error handling fix Resolves: rhbz#2375742 --- .gitignore | 1 + rsyslog.spec | 8 +++++++- sources | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 54d79dc..cef7fab 100644 --- a/.gitignore +++ b/.gitignore @@ -102,3 +102,4 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2506.0.tar.gz /rsyslog-8.2508.0.tar.gz /qpid-proton-0.40.0.tar.gz +/rsyslog-8.2510.0.tar.gz diff --git a/rsyslog.spec b/rsyslog.spec index 051c0c4..d1566f2 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -36,7 +36,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2508.0 +Version: 8.2510.0 Release: 1%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ @@ -754,6 +754,12 @@ done %changelog +* Mon Oct 20 2025 Attila Lakatos - 8.2510.0-1 +- Rebase to 8.2510.0 + Resolves: rhbz#2404131 +- imjournal open error handling fix + Resolves: rhbz#2375742 + * Fri Sep 05 2025 Attila Lakatos - 8.2508.0-1 - Rebase to 8.2508.0 Resolves: rhbz#2392918 diff --git a/sources b/sources index e23ea0e..1294997 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (rsyslog-8.2508.0.tar.gz) = 73d9cfa9e3260aacefc20acd2f30db2d6ea01fb2d309cebcc81802a9d6d756e719810572f330931027b2d21a9fb57deaadb8bf9bd0849be6da5794ff6d178a0c +SHA512 (rsyslog-8.2510.0.tar.gz) = d2e693fd8c7112e4ccc36ea6fbb19909df885e7cb2778e95c04b7c5e9db8240224decfee52308a46865b7deffcf1e31ade0104c90d84b768a4dece15e5ea190e SHA512 (qpid-proton-0.40.0.tar.gz) = 3e7fe56ca1423f45f71d81f5e1d6ec5f21c073cc580628e12a8dbd545a86805b7312834e0d1234dde43797633d575ed639f21a96239b217500cc0a824482aae3 From 3edd89e06c75ad44eb302280b5205a5dac7fed08 Mon Sep 17 00:00:00 2001 From: Attila Lakatos Date: Mon, 20 Oct 2025 09:47:39 +0200 Subject: [PATCH 41/41] Add mmleefparse module to base package --- rsyslog.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rsyslog.spec b/rsyslog.spec index d1566f2..3b67e3f 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -616,6 +616,7 @@ done %{_libdir}/rsyslog/mmanon.so %{_libdir}/rsyslog/mmcount.so %{_libdir}/rsyslog/mmexternal.so +%{_libdir}/rsyslog/mmleefparse.so %{_libdir}/rsyslog/mmutf8fix.so %{_libdir}/rsyslog/omhttp.so %{_libdir}/rsyslog/omjournal.so @@ -759,6 +760,7 @@ done Resolves: rhbz#2404131 - imjournal open error handling fix Resolves: rhbz#2375742 +- Add mmleefparse module to base package * Fri Sep 05 2025 Attila Lakatos - 8.2508.0-1 - Rebase to 8.2508.0