diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index 54c1f3c..cef7fab 100644 --- a/.gitignore +++ b/.gitignore @@ -85,3 +85,21 @@ rsyslog-4.6.3.tar.gz /rsyslog-doc-8.2204.0.tar.gz /rsyslog-8.2210.0.tar.gz /rsyslog-doc-8.2210.0.tar.gz +/rsyslog-8.2306.0.tar.gz +/rsyslog-doc-8.2306.0.tar.gz +/rsyslog-8.2308.0.tar.gz +/rsyslog-doc-8.2308.0.tar.gz +/qpid-proton-0.39.0.tar.gz +/rsyslog-8.2310.0.tar.gz +/rsyslog-doc-8.2310.0.tar.gz +/rsyslog-8.2312.0.tar.gz +/rsyslog-doc-8.2312.0.tar.gz +/rsyslog-8.2408.0.tar.gz +/rsyslog-doc-8.2408.0.tar.gz +/rsyslog-8.2412.0.tar.gz +/rsyslog-doc-8.2412.0.tar.gz +/rsyslog-8.2506.0.tar.gz +/rsyslog-doc-8.2506.0.tar.gz +/rsyslog-8.2508.0.tar.gz +/qpid-proton-0.40.0.tar.gz +/rsyslog-8.2510.0.tar.gz diff --git a/openssl3-compatibility.patch b/openssl3-compatibility.patch deleted file mode 100644 index c86fe23..0000000 --- a/openssl3-compatibility.patch +++ /dev/null @@ -1,83 +0,0 @@ -diff -up ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig ./qpid-proton-0.34.0/c/src/ssl/openssl.c ---- ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig 2021-06-01 09:29:27.976842727 +0200 -+++ ./qpid-proton-0.34.0/c/src/ssl/openssl.c 2021-06-01 09:31:05.232015887 +0200 -@@ -353,65 +353,6 @@ static int verify_callback(int preverify - return preverify_ok; - } - --// This was introduced in v1.1 --#if OPENSSL_VERSION_NUMBER < 0x10100000 --int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) --{ -- dh->p = p; -- dh->q = q; -- dh->g = g; -- return 1; --} --#endif -- --// this code was generated using the command: --// "openssl dhparam -C -2 2048" --static DH *get_dh2048(void) --{ -- static const unsigned char dhp_2048[]={ -- 0xAE,0xF7,0xE9,0x66,0x26,0x7A,0xAC,0x0A,0x6F,0x1E,0xCD,0x81, -- 0xBD,0x0A,0x10,0x7E,0xFA,0x2C,0xF5,0x2D,0x98,0xD4,0xE7,0xD9, -- 0xE4,0x04,0x8B,0x06,0x85,0xF2,0x0B,0xA3,0x90,0x15,0x56,0x0C, -- 0x8B,0xBE,0xF8,0x48,0xBB,0x29,0x63,0x75,0x12,0x48,0x9D,0x7E, -- 0x7C,0x24,0xB4,0x3A,0x38,0x7E,0x97,0x3C,0x77,0x95,0xB0,0xA2, -- 0x72,0xB6,0xE9,0xD8,0xB8,0xFA,0x09,0x1B,0xDC,0xB3,0x80,0x6E, -- 0x32,0x0A,0xDA,0xBB,0xE8,0x43,0x88,0x5B,0xAB,0xC3,0xB2,0x44, -- 0xE1,0x95,0x85,0x0A,0x0D,0x13,0xE2,0x02,0x1E,0x96,0x44,0xCF, -- 0xA0,0xD8,0x46,0x32,0x68,0x63,0x7F,0x68,0xB3,0x37,0x52,0xCE, -- 0x3A,0x4E,0x48,0x08,0x7F,0xD5,0x53,0x00,0x59,0xA8,0x2C,0xCB, -- 0x51,0x64,0x3D,0x5F,0xEF,0x0E,0x5F,0xE6,0xAF,0xD9,0x1E,0xA2, -- 0x35,0x64,0x37,0xD7,0x4C,0xC9,0x24,0xFD,0x2F,0x75,0xBB,0x3A, -- 0x15,0x82,0x76,0x4D,0xC2,0x8B,0x1E,0xB9,0x4B,0xA1,0x33,0xCF, -- 0xAA,0x3B,0x7C,0xC2,0x50,0x60,0x6F,0x45,0x69,0xD3,0x6B,0x88, -- 0x34,0x9B,0xE4,0xF8,0xC6,0xC7,0x5F,0x10,0xA1,0xBA,0x01,0x8C, -- 0xDA,0xD1,0xA3,0x59,0x9C,0x97,0xEA,0xC3,0xF6,0x02,0x55,0x5C, -- 0x92,0x1A,0x39,0x67,0x17,0xE2,0x9B,0x27,0x8D,0xE8,0x5C,0xE9, -- 0xA5,0x94,0xBB,0x7E,0x16,0x6F,0x53,0x5A,0x6D,0xD8,0x03,0xC2, -- 0xAC,0x7A,0xCD,0x22,0x98,0x8E,0x33,0x2A,0xDE,0xAB,0x12,0xC0, -- 0x0B,0x7C,0x0C,0x20,0x70,0xD9,0x0B,0xAE,0x0B,0x2F,0x20,0x9B, -- 0xA4,0xED,0xFD,0x49,0x0B,0xE3,0x4A,0xF6,0x28,0xB3,0x98,0xB0, -- 0x23,0x1C,0x09,0x33, -- }; -- static const unsigned char dhg_2048[]={ -- 0x02, -- }; -- DH *dh = DH_new(); -- BIGNUM *dhp_bn, *dhg_bn; -- -- if (dh == NULL) -- return NULL; -- dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL); -- dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL); -- if (dhp_bn == NULL || dhg_bn == NULL -- || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) { -- DH_free(dh); -- BN_free(dhp_bn); -- BN_free(dhg_bn); -- return NULL; -- } -- return dh; --} -- - typedef struct { - char *id; - SSL_SESSION *session; -@@ -542,13 +483,6 @@ static bool pni_init_ssl_domain( pn_ssl_ - domain->default_seclevel = SSL_CTX_get_security_level(domain->ctx); - # endif - -- DH *dh = get_dh2048(); -- if (dh) { -- SSL_CTX_set_tmp_dh(domain->ctx, dh); -- DH_free(dh); -- SSL_CTX_set_options(domain->ctx, SSL_OP_SINGLE_DH_USE); -- } -- - return true; - } - diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..ae0c305 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,6 @@ +summary: Run all tests +execute: + how: tmt +discover: + how: fmf + diff --git a/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch b/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch deleted file mode 100644 index cb583fb..0000000 --- a/rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch +++ /dev/null @@ -1,261 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 9f73a708d0..958c26245e 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -377,6 +377,28 @@ AC_ARG_ENABLE(fmhash, - [enable_fmhash=yes] - ) - -+AC_ARG_ENABLE(libcap-ng, -+ [AS_HELP_STRING([--enable-libcap-ng],[Enable dropping capabilities to only the necessary set @<:@default=no@:>@])], -+ [case "${enableval}" in -+ yes) enable_libcapng="yes" ;; -+ no) enable_libcapng="no" ;; -+ *) AC_MSG_ERROR(bad value ${enableval} for --enable_libcapng) ;; -+ esac], -+ [enable_libcapng=no] -+) -+ -+if test "$enable_libcapng" = "yes"; then -+ PKG_CHECK_MODULES( -+ [LIBCAPNG], -+ [libcap-ng >= 0.8.2], -+ [AC_DEFINE([ENABLE_LIBCAPNG], [1], [Indicator that libcap-ng is present])], -+ [AC_MSG_ERROR(libcap-ng is not present.)] -+ ) -+ CFLAGS="$CFLAGS $LIBCAPNG_CFLAGS" -+ LIBS="$LIBS $LIBCAPNG_LIBS" -+fi -+ -+ - AC_ARG_ENABLE(fmhash-xxhash, - [AS_HELP_STRING([--enable-fmhash-xxhash],[Enable xxhash in fmhash support @<:@default=no@:>@])], - [case "${enableval}" in -@@ -2820,6 +2842,8 @@ echo " liblogging-stdlog support enabled: $enable_liblogging_stdlog" - echo " libsystemd enabled: $enable_libsystemd" - echo " kafka static linking enabled: $enable_kafka_static" - echo " atomic operations enabled: $enable_atomic_operations" -+echo " libcap-ng support enabled: $enable_libcapng" -+ - echo - echo "---{ input plugins }---" - if test "$unamestr" != "AIX"; then -diff --git a/runtime/debug.c b/runtime/debug.c -index a655bc2e4e..6e6c9fd38f 100644 ---- a/runtime/debug.c -+++ b/runtime/debug.c -@@ -250,7 +250,7 @@ r_dbgoprint( const char *srcname, obj_t *pObj, const char *fmt, ...) - - if(!(Debug && debugging_on)) - return; -- -+ - if(!checkDbgFile(srcname)) { - return; - } -@@ -435,7 +435,7 @@ rsRetVal dbgClassInit(void) - { - rsRetVal iRet; /* do not use DEFiRet, as this makes calls into the debug system! */ - -- -+ - (void) pthread_key_create(&keyThrdName, dbgThrdNameDestruct); - - /* while we try not to use any of the real rsyslog code (to avoid infinite loops), we -diff --git a/runtime/modules.c b/runtime/modules.c -index 810b2e9b52..b39bd9f066 100644 ---- a/runtime/modules.c -+++ b/runtime/modules.c -@@ -595,7 +595,7 @@ doModInit(pModInit_t modInit, uchar *name, void *pModHdlr, modInfo_t **pNewModul - CHKiRet((*pNew->modQueryEtryPt)((uchar*)"getKeepType", &modGetKeepType)); - CHKiRet((*modGetKeepType)(&pNew->eKeepType)); - dbgprintf("module %s of type %d being loaded (keepType=%d).\n", name, pNew->eType, pNew->eKeepType); -- -+ - /* OK, we know we can successfully work with the module. So we now fill the - * rest of the data elements. First we load the interfaces common to all - * module types. -@@ -1242,7 +1242,7 @@ Load(uchar *const pModName, const sbool bConfLoad, struct nvlst *const lst) - } - - iLoadCnt++; -- -+ - } while(pModHdlr == NULL && *pModName != '/' && pModDirNext); - - if(load_err_msg != NULL) { -@@ -1323,7 +1323,7 @@ modulesProcessCnf(struct cnfobj *o) - - cnfModName = (uchar*)es_str2cstr(pvals[typeIdx].val.d.estr, NULL); - iRet = Load(cnfModName, 1, o->nvlst); -- -+ - finalize_it: - free(cnfModName); - cnfparamvalsDestruct(pvals, &pblk); -diff --git a/runtime/rsconf.c b/runtime/rsconf.c -index 4620ff8d13..de2a21b406 100644 ---- a/runtime/rsconf.c -+++ b/runtime/rsconf.c -@@ -34,6 +34,10 @@ - #include - #include - #include -+#ifdef ENABLE_LIBCAPNG -+ #include -+#endif -+ - - #include "rsyslog.h" - #include "obj.h" -@@ -656,6 +660,7 @@ rsRetVal doDropPrivGid(rsconf_t *cnf) - uchar szBuf[1024]; - DEFiRet; - -+#ifndef ENABLE_LIBCAPNG - if(!cnf->globals.gidDropPrivKeepSupplemental) { - res = setgroups(0, NULL); /* remove all supplemental group IDs */ - if(res) { -@@ -668,9 +673,19 @@ rsRetVal doDropPrivGid(rsconf_t *cnf) - res = setgid(cnf->globals.gidDropPriv); - if(res) { - LogError(errno, RS_RET_ERR_DROP_PRIV, -- "could not set requested group id %d", cnf->globals.gidDropPriv); -+ "could not set requested group id %d via setgid()", cnf->globals.gidDropPriv); - ABORT_FINALIZE(RS_RET_ERR_DROP_PRIV); - } -+#else -+ int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP; -+ res = capng_change_id(-1, cnf->globals.gidDropPriv, capng_flags); -+ if (res) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not set requested group id %d via capng_change_id()", cnf->globals.gidDropPriv); -+ ABORT_FINALIZE(RS_RET_LIBCAPNG_ERR); -+ } -+#endif -+ - DBGPRINTF("setgid(%d): %d\n", cnf->globals.gidDropPriv, res); - snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's groupid changed to %d", - cnf->globals.gidDropPriv); -@@ -705,12 +720,18 @@ static void doDropPrivUid(rsconf_t *cnf) - cnf->globals.uidDropPriv); - } - -+#ifndef ENABLE_LIBCAPNG - res = setuid(cnf->globals.uidDropPriv); -+#else -+ int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP; -+ res = capng_change_id(cnf->globals.uidDropPriv, -1, capng_flags); -+#endif - if(res) { - /* if we can not set the userid, this is fatal, so let's unconditionally abort */ - perror("could not set requested userid"); - exit(1); - } -+ - DBGPRINTF("setuid(%d): %d\n", cnf->globals.uidDropPriv, res); - snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's userid changed to %d", cnf->globals.uidDropPriv); - logmsgInternal(NO_ERRCODE, LOG_SYSLOG|LOG_INFO, szBuf, 0); -@@ -739,6 +760,29 @@ dropPrivileges(rsconf_t *cnf) - cnf->globals.uidDropPriv); - } - -+#ifdef ENABLE_LIBCAPNG -+ /* In case privileges were dropped, do not allow bypassing -+ * file read, write, and execute permission checks -+ */ -+ if (cnf->globals.gidDropPriv != 0 || cnf->globals.uidDropPriv != 0) { -+ int capng_rc; -+ if ((capng_rc = capng_update(CAPNG_DROP, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_DAC_OVERRIDE)) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not update the internal posix capabilities settings " -+ "based on the options passed to it, capng_update=%d\n", capng_rc); -+ exit(-1); -+ } -+ -+ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not transfer the specified internal posix capabilities " -+ "settings to the kernel, capng_apply=%d\n", capng_rc); -+ exit(-1); -+ } -+ } -+ -+#endif -+ - finalize_it: - RETiRet; - } -diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h -index 908e5e7b73..01616d8f7d 100644 ---- a/runtime/rsyslog.h -+++ b/runtime/rsyslog.h -@@ -604,6 +604,7 @@ enum rsRetVal_ /** return value. All methods return this if not specified oth - RS_RET_REDIS_ERROR = -2452, /**< redis-specific error. See message foe details. */ - RS_RET_REDIS_AUTH_FAILED = -2453, /**< redis authentication failure */ - RS_RET_FAUP_INIT_OPTIONS_FAILED = -2454, /**< could not initialize faup options */ -+ RS_RET_LIBCAPNG_ERR = -2455, /**< error during dropping the capabilities */ - - /* RainerScript error messages (range 1000.. 1999) */ - RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */ -diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c -index 31b91a1bd1..77d814b482 100644 ---- a/tools/rsyslogd.c -+++ b/tools/rsyslogd.c -@@ -37,6 +37,9 @@ - #ifdef HAVE_LIBSYSTEMD - # include - #endif -+#ifdef ENABLE_LIBCAPNG -+ #include -+#endif - - #include "rsyslog.h" - #include "wti.h" -@@ -2167,6 +2170,46 @@ main(int argc, char **argv) - fjson_global_do_case_sensitive_comparison(0); - - dbgClassInit(); -+ -+#ifdef ENABLE_LIBCAPNG -+ /* -+ * Drop capabilities to the necessary set -+ */ -+ int capng_rc; -+ capng_clear(CAPNG_SELECT_BOTH); -+ -+ if ((capng_rc = capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, -+ CAP_BLOCK_SUSPEND, -+ CAP_CHOWN, -+ CAP_IPC_LOCK, -+ CAP_LEASE, -+ CAP_NET_ADMIN, -+ CAP_NET_BIND_SERVICE, -+ CAP_DAC_OVERRIDE, -+ CAP_SETGID, -+ CAP_SETUID, -+ CAP_SETPCAP, -+ CAP_SYS_ADMIN, -+ CAP_SYS_CHROOT, -+ CAP_SYS_RESOURCE, -+ CAP_SYSLOG, -+ -1 -+ )) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not update the internal posix capabilities settings " -+ "based on the options passed to it, capng_updatev=%d\n", capng_rc); -+ exit(-1); -+ } -+ -+ if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) { -+ LogError(0, RS_RET_LIBCAPNG_ERR, -+ "could not transfer the specified internal posix capabilities " -+ "settings to the kernel, capng_apply=%d\n", capng_rc); -+ exit(-1); -+ } -+ DBGPRINTF("Capabilities were dropped successfully\n"); -+#endif -+ - initAll(argc, argv); - #ifdef HAVE_LIBSYSTEMD - sd_notify(0, "READY=1"); diff --git a/rsyslog.conf b/rsyslog.conf index f6d3f6a..4486f1f 100644 --- a/rsyslog.conf +++ b/rsyslog.conf @@ -18,6 +18,8 @@ module(load="imuxsock" # provides support for local system logging (e.g. via SysSock.Use="off") # Turn off message reception via local log socket; # local messages are retrieved through imjournal now. module(load="imjournal" # provides access to the systemd journal + FileCreateMode="0600" # Quiet warning and ensure privacy + UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from StateFile="imjournal.state") # File to store the position in the journal # Include all config files in /etc/rsyslog.d/ diff --git a/rsyslog.log b/rsyslog.log index b101e32..42b31c8 100644 --- a/rsyslog.log +++ b/rsyslog.log @@ -7,6 +7,6 @@ missingok sharedscripts postrotate - /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true + /usr/bin/systemctl reload rsyslog.service >/dev/null 2>&1 || true endscript } diff --git a/rsyslog.service b/rsyslog.service index 9c13b1d..738f087 100644 --- a/rsyslog.service +++ b/rsyslog.service @@ -3,6 +3,8 @@ Description=System Logging Service ;Requires=syslog.socket Documentation=man:rsyslogd(8) Documentation=https://www.rsyslog.com/doc/ +Wants=network.target network-online.target +After=network.target network-online.target [Service] Type=notify @@ -12,6 +14,19 @@ ExecReload=/usr/bin/kill -HUP $MAINPID UMask=0066 StandardOutput=null Restart=on-failure +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=net +NoNewPrivileges=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete +LockPersonality=yes +MemoryDenyWriteExecute=yes + # Increase the default a bit in order to allow many simultaneous # files to be monitored, we might need a lot of fds. diff --git a/rsyslog.spec b/rsyslog.spec index 6d8ce51..3b67e3f 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -1,6 +1,7 @@ %define rsyslog_statedir %{_sharedstatedir}/rsyslog %define rsyslog_pkidir %{_sysconfdir}/pki/rsyslog %define rsyslog_docdir %{_docdir}/rsyslog +%define qpid_proton_v 0.40.0 # The following packages are not enabled on rhel: # hiredis, libdbi, mongodb, rabbitmq # The omamqp1 plugin is built differently as qpid-proton is not available on rhel @@ -31,25 +32,22 @@ %bcond_without pgsql %bcond_without snmp %bcond_without udpspoof +%bcond_without mmtaghostname Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2210.0 -Release: 4%{?dist} -License: (GPLv3+ and ASL 2.0) +Version: 8.2510.0 +Release: 1%{?dist} +License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz -Source1: http://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{version}.tar.gz -Source2: rsyslog.conf -Source3: rsyslog.sysconfig -Source4: rsyslog.log -Source5: rsyslog.service +Source1: rsyslog.conf +Source2: rsyslog.sysconfig +Source3: rsyslog.log +Source4: rsyslog.service # Add qpid-proton as another source, enable omamqp1 module in a # separatae sub-package with it statically linked(see rhbz#1713427) -Source6: qpid-proton-0.34.0.tar.gz - -Patch0: openssl3-compatibility.patch -Patch1: rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch +Source5: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz BuildRequires: make BuildRequires: gcc @@ -58,7 +56,6 @@ BuildRequires: automake BuildRequires: bison BuildRequires: dos2unix BuildRequires: flex -BuildRequires: libgcrypt-devel BuildRequires: libfastjson-devel >= 0.99.8 BuildRequires: libestr-devel >= 0.1.9 BuildRequires: libtool @@ -71,18 +68,15 @@ BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel BuildRequires: libcap-ng-devel -Recommends: %{name}-logrotate = %version-%release +Recommends: logrotate +Obsoletes: rsyslog-logrotate < 8.2310.0-2 +Provides: rsyslog-logrotate = %{version}-%{release} Requires: bash >= 2.0 %{?systemd_ordering} Provides: syslog Obsoletes: sysklogd < 1.5-11 -%package logrotate -Summary: Log rotation for rsyslog -Requires: %name = %version-%release -Requires: logrotate >= 3.5.2 - %package crypto Summary: Encryption support Requires: %name = %version-%release @@ -113,6 +107,12 @@ Requires: %name = %version-%release Summary: Fields extraction module Requires: %name = %version-%release +%if %{with mmtaghostname} +%package mmtaghostname +Summary: Message modification module supporting adding tags +Requires: %name = %version-%release +%endif + %if %{with snmp} %package mmsnmptrapd Summary: Message modification module for snmptrapd generated messages @@ -241,9 +241,6 @@ and can be used as a drop-in replacement. Rsyslog is simple to set up, with advanced features suitable for enterprise-class, encryption-protected syslog relay chains. -%description logrotate -This subpackage contains the default logrotate configuration for rsyslog. - %description crypto This package contains a module providing log file encryption and a command line tool to process encrypted logs. @@ -272,6 +269,9 @@ advantage if a field-based log format is to be processed, like for example CEF and either a large number of fields is needed or a specific field is used multiple times inside filters. +%description mmtaghostname +This module provides message modification for changing or adding the host name. + %if %{with snmp} %description mmsnmptrapd This message modification module takes messages generated from snmptrapd and @@ -372,23 +372,14 @@ This module allows rsyslog to send messages to a RabbitMQ server. %endif %prep -# set up rsyslog-doc sources -%setup -q -a 1 -T -c -rm -r LICENSE README.md source build/objects.inv -mv build doc # set up rsyslog sources %setup -q -D %if %{with omamqp1} # Unpack qpid-proton -%setup -q -D -T -b 6 -pushd .. -%patch0 -p1 -b .openssl-compatibility -popd +%setup -q -D -T -b 5 %endif -%patch1 -p1 -b .libcap-ng - %build %ifarch sparc64 #sparc64 need big PIC @@ -400,19 +391,18 @@ export CFLAGS="$RPM_OPT_FLAGS -fpic" %if %{with omamqp1} # build the proton first ( - cd %{_builddir}/qpid-proton-0.34.0 + cd %{_builddir}/qpid-proton-%{qpid_proton_v} mkdir bld cd bld # Need ENABLE_FUZZ_TESTING=NO to avoid a link failure - # Find python include dir and python library from - # https://stackoverflow.com/questions/24174394/cmake-is-not-able-to-find-python-libraries + # Modern approach for Python discovery in CMake cmake .. \ -DBUILD_BINDINGS="" \ -DBUILD_STATIC_LIBS=YES \ -DENABLE_FUZZ_TESTING=NO \ - -DPYTHON_INCLUDE_DIR=$(python3 -c "from distutils.sysconfig import get_python_inc; print(get_python_inc())") \ - -DPYTHON_LIBRARY=$(python3 -c "import distutils.sysconfig as sysconfig; print(sysconfig.get_config_var('LIBDIR'))") \ + -DPython_FIND_STRATEGY=LOCATION \ + -DPython_ROOT_DIR=/usr \ -DCMAKE_AR="/usr/bin/gcc-ar" -DCMAKE_NM="/usr/bin/gcc-nm" -DCMAKE_RANLIB="/usr/bin/gcc-ranlib" make -j8 ) @@ -462,7 +452,7 @@ autoreconf -if --enable-omrabbitmq \ %endif %if %{with omamqp1} - --enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-0.34.0/bld/c/include" \ + --enable-omamqp1 PROTON_PROACTOR_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_PROACTOR_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ %endif --enable-elasticsearch \ --enable-generate-man-pages \ @@ -491,6 +481,9 @@ autoreconf -if --enable-mmkubernetes \ --enable-mmjsonparse \ --enable-mmnormalize \ +%if %{with mmtaghostname} + --enable-mmtaghostname \ +%endif %if %{with snmp} --enable-mmsnmptrapd \ %endif @@ -520,7 +513,9 @@ autoreconf -if --enable-snmp \ %endif --enable-unlimited-select \ - --enable-usertools + --enable-usertools \ + --disable-libgcrypt \ + --enable-openssl_crypto_provider make V=1 @@ -538,10 +533,10 @@ install -d -m 700 %{buildroot}%{rsyslog_statedir} install -d -m 700 %{buildroot}%{rsyslog_pkidir} install -d -m 755 %{buildroot}%{rsyslog_docdir}/html -install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/rsyslog.conf -install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog -install -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog -install -p -m 644 %{SOURCE5} %{buildroot}%{_unitdir}/rsyslog.service +install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/rsyslog.conf +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog +install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog +install -p -m 644 %{SOURCE4} %{buildroot}%{_unitdir}/rsyslog.service %if %{with mysql} install -p -m 644 plugins/ommysql/createDB.sql %{buildroot}%{rsyslog_docdir}/mysql-createDB.sql @@ -580,8 +575,8 @@ done %{!?_licensedir:%global license %%doc} %license COPYING* %doc AUTHORS ChangeLog README.md -%{rsyslog_docdir} %exclude %{rsyslog_docdir}/html +%exclude %{rsyslog_docdir}/recover_qi.pl %if %{with mysql} %exclude %{rsyslog_docdir}/mysql-createDB.sql %endif @@ -598,6 +593,7 @@ done %{_unitdir}/rsyslog.service %config(noreplace) %{_sysconfdir}/rsyslog.conf %config(noreplace) %{_sysconfdir}/sysconfig/rsyslog +%config(noreplace) %{_sysconfdir}/logrotate.d/rsyslog # plugins %{_libdir}/rsyslog/fmhash.so %{_libdir}/rsyslog/fmhttp.so @@ -620,6 +616,7 @@ done %{_libdir}/rsyslog/mmanon.so %{_libdir}/rsyslog/mmcount.so %{_libdir}/rsyslog/mmexternal.so +%{_libdir}/rsyslog/mmleefparse.so %{_libdir}/rsyslog/mmutf8fix.so %{_libdir}/rsyslog/omhttp.so %{_libdir}/rsyslog/omjournal.so @@ -642,16 +639,14 @@ done %{_libdir}/rsyslog/omclickhouse.so %endif -%files logrotate -%config(noreplace) %{_sysconfdir}/logrotate.d/rsyslog - %files crypto %{_bindir}/rscryutil %{_mandir}/man1/rscryutil.1.gz -%{_libdir}/rsyslog/lmcry_gcry.so +%{_libdir}/rsyslog/lmcry_ossl.so %files doc -%doc %{rsyslog_docdir}/html +%{rsyslog_docdir}/html +%{rsyslog_docdir}/recover_qi.pl %files elasticsearch %{_libdir}/rsyslog/omelasticsearch.so @@ -668,6 +663,9 @@ done %files mmnormalize %{_libdir}/rsyslog/mmnormalize.so +%files mmtaghostname +%{_libdir}/rsyslog/mmtaghostname.so + %if %{with snmp} %files mmsnmptrapd %{_libdir}/rsyslog/mmsnmptrapd.so @@ -757,6 +755,90 @@ done %changelog +* Mon Oct 20 2025 Attila Lakatos - 8.2510.0-1 +- Rebase to 8.2510.0 + Resolves: rhbz#2404131 +- imjournal open error handling fix + Resolves: rhbz#2375742 +- Add mmleefparse module to base package + +* Fri Sep 05 2025 Attila Lakatos - 8.2508.0-1 +- Rebase to 8.2508.0 + Resolves: rhbz#2392918 + +* Fri Jul 25 2025 Fedora Release Engineering - 8.2506.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Jun 12 2025 Attila Lakatos - 8.2506.0-1 +- Rebase to 8.2506.0 + Resolves: rhbz#2347628 + +* Tue Jan 21 2025 Attila Lakatos - 8.2412.0-3 +- Fix build problem by resolving -Wincompatible-pointer-types error + +* Sat Jan 18 2025 Fedora Release Engineering - 8.2412.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Thu Dec 05 2024 Attila Lakatos - 8.2412.0-1 +- Rebase to 8.2412.0 +- Harden rsyslog service unit +- Disable openssl engines support + Resolves: rhbz#2320050 + +* Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 +- Rebuild package + Resolves: rhbz#2316361 + +* Wed Aug 21 2024 Attila Lakatos - 8.2408.0-1 +- Rebase to 8.2408.0 + Resolves: rhbz#2266329 + Resolves: rhbz#2301246 + Resolves: rhbz#2305398 + +* Fri Jul 19 2024 Fedora Release Engineering - 8.2312.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed May 29 2024 Orion Poplawski - 8.2312.0-3 +- Explicitly set imjournal FileCreateMode to quiet warning + +* Sat May 11 2024 Kevin Fenzi - 8.2312.0-2 +- rebuild for hiredis soname bump + +* Mon Feb 12 2024 Attila Lakatos - 8.2312.0-1 +- Rebase to 8.2312.0 + resolves: rhbz#2232275 + +* Fri Jan 26 2024 Fedora Release Engineering - 8.2310.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 8.2310.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jan 04 2024 Attila Lakatos - 8.2310.0-2 +- Move rsyslog related logrotate config to the base package + resolves: rhbz#2242243 + +* Fri Aug 25 2023 Attila Lakatos - 8.2310.0-1 +- Rebase to 8.2310.0 + resolves: rhbz#2232275 + +* Wed Aug 16 2023 Stewart Smith - 8.2306.0-4 +- Add mmtaghostname module as a subpackage + +* Fri Jul 21 2023 Fedora Release Engineering - 8.2306.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jul 15 2023 Yaroslav Fedevych - 8.2306.0-2 +- Specify qpid-proton's source as full URL to fix isolated builds + +* Wed Jun 21 2023 Attila Lakatos - 8.2306.0-1 +- rebase to 8.2306.0 + resolves: rhbz#2151339 + resolves: rhbz#2151092 + +* Wed May 10 2023 Todd Zullinger - 8.2210.0-5 +- Use 'systemctl reload' in logrotate script + * Fri Jan 20 2023 Fedora Release Engineering - 8.2210.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 4004c45..1294997 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3 -SHA512 (rsyslog-8.2210.0.tar.gz) = c665b7f7a3c5ef31c9b62b50f815cfbb52db0cbe4a06934f4f1c3cd2a56fb49c319d33857ee92ab843aa5894cac16c16b8eccdf83714f31ab57a95049c4af231 -SHA512 (rsyslog-doc-8.2210.0.tar.gz) = e7847a9307a91fdf87d6cf91d2391eb75869679905b9598310c456fb3fe1864fc06dbdc649778f5b3788e47ffda0a6d89cb894258e55db441f7df7e74b0ae9f4 +SHA512 (rsyslog-8.2510.0.tar.gz) = d2e693fd8c7112e4ccc36ea6fbb19909df885e7cb2778e95c04b7c5e9db8240224decfee52308a46865b7deffcf1e31ade0104c90d84b768a4dece15e5ea190e +SHA512 (qpid-proton-0.40.0.tar.gz) = 3e7fe56ca1423f45f71d81f5e1d6ec5f21c073cc580628e12a8dbd545a86805b7312834e0d1234dde43797633d575ed639f21a96239b217500cc0a824482aae3 diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/tests/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf new file mode 100644 index 0000000..a90b249 --- /dev/null +++ b/tests/got-audit/main.fmf @@ -0,0 +1,10 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit + diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh new file mode 100755 index 0000000..03761a1 --- /dev/null +++ b/tests/got-audit/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/rsyslog/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlServiceStart rsyslog + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID rsyslog.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore rsyslog + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/main.fmf b/tests/main.fmf new file mode 100644 index 0000000..f225a72 --- /dev/null +++ b/tests/main.fmf @@ -0,0 +1,2 @@ +test: ./runtest.sh +framework: beakerlib