diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index c2bb745..cef7fab 100644 --- a/.gitignore +++ b/.gitignore @@ -83,3 +83,23 @@ rsyslog-4.6.3.tar.gz /qpid-proton-0.34.0.tar.gz /rsyslog-8.2204.0.tar.gz /rsyslog-doc-8.2204.0.tar.gz +/rsyslog-8.2210.0.tar.gz +/rsyslog-doc-8.2210.0.tar.gz +/rsyslog-8.2306.0.tar.gz +/rsyslog-doc-8.2306.0.tar.gz +/rsyslog-8.2308.0.tar.gz +/rsyslog-doc-8.2308.0.tar.gz +/qpid-proton-0.39.0.tar.gz +/rsyslog-8.2310.0.tar.gz +/rsyslog-doc-8.2310.0.tar.gz +/rsyslog-8.2312.0.tar.gz +/rsyslog-doc-8.2312.0.tar.gz +/rsyslog-8.2408.0.tar.gz +/rsyslog-doc-8.2408.0.tar.gz +/rsyslog-8.2412.0.tar.gz +/rsyslog-doc-8.2412.0.tar.gz +/rsyslog-8.2506.0.tar.gz +/rsyslog-doc-8.2506.0.tar.gz +/rsyslog-8.2508.0.tar.gz +/qpid-proton-0.40.0.tar.gz +/rsyslog-8.2510.0.tar.gz diff --git a/openssl3-compatibility.patch b/openssl3-compatibility.patch deleted file mode 100644 index c86fe23..0000000 --- a/openssl3-compatibility.patch +++ /dev/null @@ -1,83 +0,0 @@ -diff -up ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig ./qpid-proton-0.34.0/c/src/ssl/openssl.c ---- ./qpid-proton-0.34.0/c/src/ssl/openssl.c.orig 2021-06-01 09:29:27.976842727 +0200 -+++ ./qpid-proton-0.34.0/c/src/ssl/openssl.c 2021-06-01 09:31:05.232015887 +0200 -@@ -353,65 +353,6 @@ static int verify_callback(int preverify - return preverify_ok; - } - --// This was introduced in v1.1 --#if OPENSSL_VERSION_NUMBER < 0x10100000 --int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) --{ -- dh->p = p; -- dh->q = q; -- dh->g = g; -- return 1; --} --#endif -- --// this code was generated using the command: --// "openssl dhparam -C -2 2048" --static DH *get_dh2048(void) --{ -- static const unsigned char dhp_2048[]={ -- 0xAE,0xF7,0xE9,0x66,0x26,0x7A,0xAC,0x0A,0x6F,0x1E,0xCD,0x81, -- 0xBD,0x0A,0x10,0x7E,0xFA,0x2C,0xF5,0x2D,0x98,0xD4,0xE7,0xD9, -- 0xE4,0x04,0x8B,0x06,0x85,0xF2,0x0B,0xA3,0x90,0x15,0x56,0x0C, -- 0x8B,0xBE,0xF8,0x48,0xBB,0x29,0x63,0x75,0x12,0x48,0x9D,0x7E, -- 0x7C,0x24,0xB4,0x3A,0x38,0x7E,0x97,0x3C,0x77,0x95,0xB0,0xA2, -- 0x72,0xB6,0xE9,0xD8,0xB8,0xFA,0x09,0x1B,0xDC,0xB3,0x80,0x6E, -- 0x32,0x0A,0xDA,0xBB,0xE8,0x43,0x88,0x5B,0xAB,0xC3,0xB2,0x44, -- 0xE1,0x95,0x85,0x0A,0x0D,0x13,0xE2,0x02,0x1E,0x96,0x44,0xCF, -- 0xA0,0xD8,0x46,0x32,0x68,0x63,0x7F,0x68,0xB3,0x37,0x52,0xCE, -- 0x3A,0x4E,0x48,0x08,0x7F,0xD5,0x53,0x00,0x59,0xA8,0x2C,0xCB, -- 0x51,0x64,0x3D,0x5F,0xEF,0x0E,0x5F,0xE6,0xAF,0xD9,0x1E,0xA2, -- 0x35,0x64,0x37,0xD7,0x4C,0xC9,0x24,0xFD,0x2F,0x75,0xBB,0x3A, -- 0x15,0x82,0x76,0x4D,0xC2,0x8B,0x1E,0xB9,0x4B,0xA1,0x33,0xCF, -- 0xAA,0x3B,0x7C,0xC2,0x50,0x60,0x6F,0x45,0x69,0xD3,0x6B,0x88, -- 0x34,0x9B,0xE4,0xF8,0xC6,0xC7,0x5F,0x10,0xA1,0xBA,0x01,0x8C, -- 0xDA,0xD1,0xA3,0x59,0x9C,0x97,0xEA,0xC3,0xF6,0x02,0x55,0x5C, -- 0x92,0x1A,0x39,0x67,0x17,0xE2,0x9B,0x27,0x8D,0xE8,0x5C,0xE9, -- 0xA5,0x94,0xBB,0x7E,0x16,0x6F,0x53,0x5A,0x6D,0xD8,0x03,0xC2, -- 0xAC,0x7A,0xCD,0x22,0x98,0x8E,0x33,0x2A,0xDE,0xAB,0x12,0xC0, -- 0x0B,0x7C,0x0C,0x20,0x70,0xD9,0x0B,0xAE,0x0B,0x2F,0x20,0x9B, -- 0xA4,0xED,0xFD,0x49,0x0B,0xE3,0x4A,0xF6,0x28,0xB3,0x98,0xB0, -- 0x23,0x1C,0x09,0x33, -- }; -- static const unsigned char dhg_2048[]={ -- 0x02, -- }; -- DH *dh = DH_new(); -- BIGNUM *dhp_bn, *dhg_bn; -- -- if (dh == NULL) -- return NULL; -- dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL); -- dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL); -- if (dhp_bn == NULL || dhg_bn == NULL -- || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) { -- DH_free(dh); -- BN_free(dhp_bn); -- BN_free(dhg_bn); -- return NULL; -- } -- return dh; --} -- - typedef struct { - char *id; - SSL_SESSION *session; -@@ -542,13 +483,6 @@ static bool pni_init_ssl_domain( pn_ssl_ - domain->default_seclevel = SSL_CTX_get_security_level(domain->ctx); - # endif - -- DH *dh = get_dh2048(); -- if (dh) { -- SSL_CTX_set_tmp_dh(domain->ctx, dh); -- DH_free(dh); -- SSL_CTX_set_options(domain->ctx, SSL_OP_SINGLE_DH_USE); -- } -- - return true; - } - diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..ae0c305 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,6 @@ +summary: Run all tests +execute: + how: tmt +discover: + how: fmf + diff --git a/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch b/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch deleted file mode 100644 index cfdfc59..0000000 --- a/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch +++ /dev/null @@ -1,45 +0,0 @@ -diff --git a/contrib/imhttp/imhttp.c b/contrib/imhttp/imhttp.c -index f09260b586..95704af985 100644 ---- a/contrib/imhttp/imhttp.c -+++ b/contrib/imhttp/imhttp.c -@@ -487,7 +487,9 @@ processOctetMsgLen(const instanceConf_t *const inst, struct conn_wrkr_s *connWrk - connWrkr->parseState.iOctetsRemain = connWrkr->parseState.iOctetsRemain * 10 + ch - '0'; - } - // temporarily save this character into the message buffer -- connWrkr->pMsg[connWrkr->iMsg++] = ch; -+ if(connWrkr->iMsg + 1 < s_iMaxLine) { -+ connWrkr->pMsg[connWrkr->iMsg++] = ch; -+ } - } else { - const char *remoteAddr = ""; - if (connWrkr->propRemoteAddr) { -diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c -index 2df46a236c..c32dec5851 100644 ---- a/plugins/imptcp/imptcp.c -+++ b/plugins/imptcp/imptcp.c -@@ -1107,7 +1107,9 @@ processDataRcvd(ptcpsess_t *const __restrict__ pThis, - if(pThis->iOctetsRemain <= 200000000) { - pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0'; - } -- *(pThis->pMsg + pThis->iMsg++) = c; -+ if(pThis->iMsg < iMaxLine) { -+ *(pThis->pMsg + pThis->iMsg++) = c; -+ } - } else { /* done with the octet count, so this must be the SP terminator */ - DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain); - prop.GetString(pThis->peerName, &propPeerName, &lenPeerName); -diff --git a/runtime/tcps_sess.c b/runtime/tcps_sess.c -index 0efa2c23c4..c5442f7638 100644 ---- a/runtime/tcps_sess.c -+++ b/runtime/tcps_sess.c -@@ -390,7 +390,9 @@ processDataRcvd(tcps_sess_t *pThis, - if(pThis->iOctetsRemain <= 200000000) { - pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0'; - } -- *(pThis->pMsg + pThis->iMsg++) = c; -+ if(pThis->iMsg < iMaxLine) { -+ *(pThis->pMsg + pThis->iMsg++) = c; -+ } - } else { /* done with the octet count, so this must be the SP terminator */ - DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain); - prop.GetString(pThis->fromHost, &propPeerName, &lenPeerName); diff --git a/rsyslog.conf b/rsyslog.conf index f6d3f6a..4486f1f 100644 --- a/rsyslog.conf +++ b/rsyslog.conf @@ -18,6 +18,8 @@ module(load="imuxsock" # provides support for local system logging (e.g. via SysSock.Use="off") # Turn off message reception via local log socket; # local messages are retrieved through imjournal now. module(load="imjournal" # provides access to the systemd journal + FileCreateMode="0600" # Quiet warning and ensure privacy + UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from StateFile="imjournal.state") # File to store the position in the journal # Include all config files in /etc/rsyslog.d/ diff --git a/rsyslog.log b/rsyslog.log index b101e32..42b31c8 100644 --- a/rsyslog.log +++ b/rsyslog.log @@ -7,6 +7,6 @@ missingok sharedscripts postrotate - /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true + /usr/bin/systemctl reload rsyslog.service >/dev/null 2>&1 || true endscript } diff --git a/rsyslog.service b/rsyslog.service index 9c13b1d..738f087 100644 --- a/rsyslog.service +++ b/rsyslog.service @@ -3,6 +3,8 @@ Description=System Logging Service ;Requires=syslog.socket Documentation=man:rsyslogd(8) Documentation=https://www.rsyslog.com/doc/ +Wants=network.target network-online.target +After=network.target network-online.target [Service] Type=notify @@ -12,6 +14,19 @@ ExecReload=/usr/bin/kill -HUP $MAINPID UMask=0066 StandardOutput=null Restart=on-failure +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=net +NoNewPrivileges=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete +LockPersonality=yes +MemoryDenyWriteExecute=yes + # Increase the default a bit in order to allow many simultaneous # files to be monitored, we might need a lot of fds. diff --git a/rsyslog.spec b/rsyslog.spec index 54efe70..3b67e3f 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -1,28 +1,53 @@ %define rsyslog_statedir %{_sharedstatedir}/rsyslog %define rsyslog_pkidir %{_sysconfdir}/pki/rsyslog %define rsyslog_docdir %{_docdir}/rsyslog +%define qpid_proton_v 0.40.0 # The following packages are not enabled on rhel: # hiredis, libdbi, mongodb, rabbitmq # The omamqp1 plugin is built differently as qpid-proton is not available on rhel +%if 0%{?rhel} +%bcond_with hiredis +%bcond_with libdbi +%bcond_with mongodb +%bcond_with rabbitmq +%else +%bcond_without hiredis +%bcond_without libdbi +%bcond_without mongodb +%bcond_without rabbitmq +%endif + +# Add options to not build with features listed below, +# the default is to build with them. +%bcond_without clickhouse +%bcond_without imdocker +%bcond_without improg +%bcond_without gnutls +%bcond_without openssl +%bcond_without gssapi +%bcond_without omamqp1 +%bcond_without rdkafka +%bcond_without relp +%bcond_without mysql +%bcond_without pgsql +%bcond_without snmp +%bcond_without udpspoof +%bcond_without mmtaghostname Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2204.0 -Release: 3%{?dist} -License: (GPLv3+ and ASL 2.0) +Version: 8.2510.0 +Release: 1%{?dist} +License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz -Source1: http://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{version}.tar.gz -Source2: rsyslog.conf -Source3: rsyslog.sysconfig -Source4: rsyslog.log -Source5: rsyslog.service +Source1: rsyslog.conf +Source2: rsyslog.sysconfig +Source3: rsyslog.log +Source4: rsyslog.service # Add qpid-proton as another source, enable omamqp1 module in a # separatae sub-package with it statically linked(see rhbz#1713427) -Source6: qpid-proton-0.34.0.tar.gz - -Patch0: openssl3-compatibility.patch -Patch1: rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch +Source5: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz BuildRequires: make BuildRequires: gcc @@ -31,7 +56,6 @@ BuildRequires: automake BuildRequires: bison BuildRequires: dos2unix BuildRequires: flex -BuildRequires: libgcrypt-devel BuildRequires: libfastjson-devel >= 0.99.8 BuildRequires: libestr-devel >= 0.1.9 BuildRequires: libtool @@ -40,22 +64,19 @@ BuildRequires: pkgconfig BuildRequires: python3-docutils # make sure systemd is in a version that isn't affected by rhbz#974132 BuildRequires: systemd-devel >= 204-8 +BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel -BuildRequires: openssl-devel +BuildRequires: libcap-ng-devel -Requires: openssl-libs -Recommends: %{name}-logrotate = %version-%release +Recommends: logrotate +Obsoletes: rsyslog-logrotate < 8.2310.0-2 +Provides: rsyslog-logrotate = %{version}-%{release} Requires: bash >= 2.0 %{?systemd_ordering} Provides: syslog Obsoletes: sysklogd < 1.5-11 -%package logrotate -Summary: Log rotation for rsyslog -Requires: %name = %version-%release -Requires: logrotate >= 3.5.2 - %package crypto Summary: Encryption support Requires: %name = %version-%release @@ -86,51 +107,77 @@ Requires: %name = %version-%release Summary: Fields extraction module Requires: %name = %version-%release +%if %{with mmtaghostname} +%package mmtaghostname +Summary: Message modification module supporting adding tags +Requires: %name = %version-%release +%endif + +%if %{with snmp} %package mmsnmptrapd Summary: Message modification module for snmptrapd generated messages Requires: %name = %version-%release +%endif +%if %{with mysql} %package mysql Summary: MySQL support for rsyslog Requires: %name = %version-%release BuildRequires: mariadb-connector-c-devel +%endif +%if %{with pgsql} %package pgsql Summary: PostgresSQL support for rsyslog Requires: %name = %version-%release BuildRequires: libpq-devel +%endif +%if %{with gssapi} %package gssapi Summary: GSSAPI authentication and encryption support for rsyslog Requires: %name = %version-%release BuildRequires: krb5-devel +%endif +%if %{with relp} %package relp Summary: RELP protocol support for rsyslog Requires: %name = %version-%release BuildRequires: librelp-devel >= 1.2.16 +%endif +%if %{with gnutls} %package gnutls Summary: TLS protocol support for rsyslog via GnuTLS library Requires: %name = %version-%release BuildRequires: gnutls-devel +%endif +%if %{with openssl} %package openssl Summary: TLS protocol support for rsyslog via OpenSSL library Group: System Environment/Daemons Requires: %name = %version-%release +Requires: openssl-libs BuildRequires: openssl-devel +%endif +%if %{with snmp} %package snmp Summary: SNMP protocol support for rsyslog Requires: %name = %version-%release BuildRequires: net-snmp-devel +%endif +%if %{with udpspoof} %package udpspoof Summary: Provides the omudpspoof module Requires: %name = %version-%release BuildRequires: libnet-devel +%endif +%if %{with omamqp1} %package omamqp1 Summary: Provides the omamqp1 module Requires: %name = %version-%release @@ -143,33 +190,42 @@ BuildRequires: gcc-c++ BuildRequires: cyrus-sasl-devel BuildRequires: openssl-devel BuildRequires: python3 +%endif +%if %{with rdkafka} %package kafka Summary: Provides the omkafka module Requires: %name = %version-%release BuildRequires: librdkafka-devel +%endif %package mmkubernetes Summary: Provides the mmkubernetes module Requires: %name = %version-%release BuildRequires: libcurl-devel -%if 0%{?rhel} == 0 +%if %{with hiredis} %package hiredis Summary: Redis support for rsyslog Requires: %name = %version-%release BuildRequires: hiredis-devel +%endif +%if %{with libdbi} %package libdbi Summary: Libdbi database support for rsyslog Requires: %name = %version-%release BuildRequires: libdbi-devel +%endif +%if %{with mongodb} %package mongodb Summary: MongoDB support for rsyslog Requires: %name = %version-%release BuildRequires: mongo-c-driver-devel snappy-devel cyrus-sasl-devel +%endif +%if %{with rabbitmq} %package rabbitmq Summary: RabbitMQ support for rsyslog Requires: %name = %version-%release @@ -185,9 +241,6 @@ and can be used as a drop-in replacement. Rsyslog is simple to set up, with advanced features suitable for enterprise-class, encryption-protected syslog relay chains. -%description logrotate -This subpackage contains the default logrotate configuration for rsyslog. - %description crypto This package contains a module providing log file encryption and a command line tool to process encrypted logs. @@ -216,91 +269,116 @@ advantage if a field-based log format is to be processed, like for example CEF and either a large number of fields is needed or a specific field is used multiple times inside filters. +%description mmtaghostname +This module provides message modification for changing or adding the host name. + +%if %{with snmp} %description mmsnmptrapd This message modification module takes messages generated from snmptrapd and modifies them so that they look like they originated from the read originator. +%endif +%if %{with mysql} %description mysql The rsyslog-mysql package contains a dynamic shared object that will add MySQL database support to rsyslog. +%endif +%if %{with pgsql} %description pgsql The rsyslog-pgsql package contains a dynamic shared object that will add PostgreSQL database support to rsyslog. +%endif +%if %{with gssapi} %description gssapi The rsyslog-gssapi package contains the rsyslog plugins which support GSSAPI authentication and secure connections. GSSAPI is commonly used for Kerberos authentication. +%endif +%if %{with relp} %description relp The rsyslog-relp package contains the rsyslog plugins that provide the ability to receive syslog messages via the reliable RELP protocol. +%endif +%if %{with gnutls} %description gnutls The rsyslog-gnutls package contains the rsyslog plugins that provide the ability to send and receive syslog messages via TCP or RELP using TLS encryption via GnuTLS library. For details refer to rsyslog doc on imtcp and omfwd modules. +%endif +%if %{with openssl} %description openssl The rsyslog-openssl package contains the rsyslog plugins that provide the ability to send and receive syslog messages via TCP or RELP using TLS encryption via OpenSSL library. For details refer to rsyslog doc on imtcp and omfwd modules. +%endif +%if %{with snmp} %description snmp The rsyslog-snmp package contains the rsyslog plugin that provides the ability to send syslog messages as SNMPv1 and SNMPv2c traps. +%endif +%if %{with udpspoof} %description udpspoof This module is similar to the regular UDP forwarder, but permits to spoof the sender address. Also, it enables to circle through a number of source ports. +%endif +%if %{with omamqp1} %description omamqp1 The omamqp1 output module can be used to send log messages via an AMQP 1.0-compatible messaging bus. +%endif +%if %{with rdkafka} %description kafka The rsyslog-kafka package provides module for Apache Kafka output. +%endif %description mmkubernetes The rsyslog-mmkubernetes package provides module for adding kubernetes container metadata. -%if 0%{?rhel} == 0 +%if %{with hiredis} %description hiredis This module provides output to Redis. +%endif +%if %{with libdbi} %description libdbi This module supports a large number of database systems via libdbi. Libdbi abstracts the database layer and provides drivers for many systems. Drivers are available via the libdbi-drivers project. +%endif +%if %{with mongodb} %description mongodb The rsyslog-mongodb package contains a dynamic shared object that will add MongoDB database support to rsyslog. +%endif +%if %{with rabbitmq} %description rabbitmq This module allows rsyslog to send messages to a RabbitMQ server. %endif %prep -# set up rsyslog-doc sources -%setup -q -a 1 -T -c -rm -r LICENSE README.md source build/objects.inv -mv build doc # set up rsyslog sources %setup -q -D -# Unpack qpid-proton -%setup -q -D -T -b 6 -pushd .. -%patch0 -p1 -b .openssl-compatibility -popd -%patch1 -p1 -b .CVE-buffer-overflow +%if %{with omamqp1} +# Unpack qpid-proton +%setup -q -D -T -b 5 +%endif %build %ifarch sparc64 @@ -309,24 +387,26 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIC" %else export CFLAGS="$RPM_OPT_FLAGS -fpic" %endif + +%if %{with omamqp1} # build the proton first ( - cd %{_builddir}/qpid-proton-0.34.0 + cd %{_builddir}/qpid-proton-%{qpid_proton_v} mkdir bld cd bld # Need ENABLE_FUZZ_TESTING=NO to avoid a link failure - # Find python include dir and python library from - # https://stackoverflow.com/questions/24174394/cmake-is-not-able-to-find-python-libraries + # Modern approach for Python discovery in CMake cmake .. \ -DBUILD_BINDINGS="" \ -DBUILD_STATIC_LIBS=YES \ -DENABLE_FUZZ_TESTING=NO \ - -DPYTHON_INCLUDE_DIR=$(python3 -c "from distutils.sysconfig import get_python_inc; print(get_python_inc())") \ - -DPYTHON_LIBRARY=$(python3 -c "import distutils.sysconfig as sysconfig; print(sysconfig.get_config_var('LIBDIR'))") \ + -DPython_FIND_STRATEGY=LOCATION \ + -DPython_ROOT_DIR=/usr \ -DCMAKE_AR="/usr/bin/gcc-ar" -DCMAKE_NM="/usr/bin/gcc-nm" -DCMAKE_RANLIB="/usr/bin/gcc-ranlib" make -j8 ) +%endif %ifarch sparc64 #sparc64 need big PIE @@ -336,34 +416,61 @@ export CFLAGS="$RPM_OPT_FLAGS -fpie" %endif export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" +%if %{with hiredis} # the hiredis-devel package doesn't provide a pkg-config file -%if 0%{?rhel} == 0 export HIREDIS_CFLAGS=-I/usr/include/hiredis export HIREDIS_LIBS="-L%{_libdir} -lhiredis" %endif + sed -i 's/%{version}/%{version}-%{release}/g' configure.ac + autoreconf -if %configure \ --prefix=/usr \ --disable-static \ --disable-testbench \ +%if %{with clickhouse} --enable-clickhouse \ +%endif +%if %{with imdocker} --enable-imdocker \ +%endif +%if %{with improg} --enable-improg \ +%endif + --enable-libcap-ng \ +%if %{with libdbi} --enable-libdbi \ - --enable-omamqp1 \ +%endif +%if %{with hiredis} --enable-omhiredis \ +%endif +%if %{with mongodb} --enable-ommongodb \ +%endif +%if %{with rabbitmq} --enable-omrabbitmq \ - --enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-0.34.0/bld/c/include" \ +%endif +%if %{with omamqp1} + --enable-omamqp1 PROTON_PROACTOR_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_PROACTOR_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/c/include -I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \ +%endif --enable-elasticsearch \ --enable-generate-man-pages \ +%if %{with gnutls} --enable-gnutls \ +%endif +%if %{with openssl} --enable-openssl \ +%endif +%if %{with gssapi} --enable-gssapi-krb5 \ +%endif --enable-imfile \ --enable-imjournal \ +%if %{with rdkafka} --enable-imkafka \ + --enable-omkafka \ +%endif --enable-impstats \ --enable-imptcp \ --enable-mail \ @@ -374,25 +481,41 @@ autoreconf -if --enable-mmkubernetes \ --enable-mmjsonparse \ --enable-mmnormalize \ +%if %{with mmtaghostname} + --enable-mmtaghostname \ +%endif +%if %{with snmp} --enable-mmsnmptrapd \ +%endif --enable-mmutf8fix \ +%if %{with mysql} --enable-mysql \ +%endif --enable-omhttp \ --enable-omjournal \ --enable-omprog \ --enable-omstdout \ +%if %{with udpspoof} --enable-omudpspoof \ +%endif --enable-omuxsock \ +%if %{with pgsql} --enable-pgsql \ +%endif --enable-pmaixforwardedfrom \ --enable-pmcisconames \ --enable-pmlastmsg \ --enable-pmsnare \ +%if %{with relp} --enable-relp \ +%endif +%if %{with snmp} --enable-snmp \ +%endif --enable-unlimited-select \ --enable-usertools \ - --enable-omkafka + --disable-libgcrypt \ + --enable-openssl_crypto_provider make V=1 @@ -410,12 +533,19 @@ install -d -m 700 %{buildroot}%{rsyslog_statedir} install -d -m 700 %{buildroot}%{rsyslog_pkidir} install -d -m 755 %{buildroot}%{rsyslog_docdir}/html -install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/rsyslog.conf -install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog -install -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog -install -p -m 644 %{SOURCE5} %{buildroot}%{_unitdir}/rsyslog.service +install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/rsyslog.conf +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog +install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/rsyslog +install -p -m 644 %{SOURCE4} %{buildroot}%{_unitdir}/rsyslog.service + +%if %{with mysql} install -p -m 644 plugins/ommysql/createDB.sql %{buildroot}%{rsyslog_docdir}/mysql-createDB.sql +%endif + +%if %{with pgsql} install -p -m 644 plugins/ompgsql/createDB.sql %{buildroot}%{rsyslog_docdir}/pgsql-createDB.sql +%endif + dos2unix tools/recover_qi.pl install -p -m 644 tools/recover_qi.pl %{buildroot}%{rsyslog_docdir}/recover_qi.pl install -p -m 644 contrib/mmkubernetes/*.rulebase %{buildroot}%{rsyslog_docdir} @@ -445,10 +575,14 @@ done %{!?_licensedir:%global license %%doc} %license COPYING* %doc AUTHORS ChangeLog README.md -%{rsyslog_docdir} %exclude %{rsyslog_docdir}/html +%exclude %{rsyslog_docdir}/recover_qi.pl +%if %{with mysql} %exclude %{rsyslog_docdir}/mysql-createDB.sql +%endif +%if %{with pgsql} %exclude %{rsyslog_docdir}/pgsql-createDB.sql +%endif %dir %{_libdir}/rsyslog %dir %{_sysconfdir}/rsyslog.d %dir %{rsyslog_statedir} @@ -459,6 +593,7 @@ done %{_unitdir}/rsyslog.service %config(noreplace) %{_sysconfdir}/rsyslog.conf %config(noreplace) %{_sysconfdir}/sysconfig/rsyslog +%config(noreplace) %{_sysconfdir}/logrotate.d/rsyslog # plugins %{_libdir}/rsyslog/fmhash.so %{_libdir}/rsyslog/fmhttp.so @@ -481,6 +616,7 @@ done %{_libdir}/rsyslog/mmanon.so %{_libdir}/rsyslog/mmcount.so %{_libdir}/rsyslog/mmexternal.so +%{_libdir}/rsyslog/mmleefparse.so %{_libdir}/rsyslog/mmutf8fix.so %{_libdir}/rsyslog/omhttp.so %{_libdir}/rsyslog/omjournal.so @@ -493,22 +629,24 @@ done %{_libdir}/rsyslog/pmcisconames.so %{_libdir}/rsyslog/pmlastmsg.so %{_libdir}/rsyslog/pmsnare.so -%if 0%{?rhel} == 0 +%if %{with imdocker} %{_libdir}/rsyslog/imdocker.so +%endif +%if %{with improg} %{_libdir}/rsyslog/improg.so +%endif +%if %{with clickhouse} %{_libdir}/rsyslog/omclickhouse.so %endif -%files logrotate -%config(noreplace) %{_sysconfdir}/logrotate.d/rsyslog - %files crypto %{_bindir}/rscryutil %{_mandir}/man1/rscryutil.1.gz -%{_libdir}/rsyslog/lmcry_gcry.so +%{_libdir}/rsyslog/lmcry_ossl.so %files doc -%doc %{rsyslog_docdir}/html +%{rsyslog_docdir}/html +%{rsyslog_docdir}/recover_qi.pl %files elasticsearch %{_libdir}/rsyslog/omelasticsearch.so @@ -525,67 +663,200 @@ done %files mmnormalize %{_libdir}/rsyslog/mmnormalize.so +%files mmtaghostname +%{_libdir}/rsyslog/mmtaghostname.so + +%if %{with snmp} %files mmsnmptrapd %{_libdir}/rsyslog/mmsnmptrapd.so +%endif +%if %{with mysql} %files mysql %doc %{rsyslog_docdir}/mysql-createDB.sql %{_libdir}/rsyslog/ommysql.so +%endif +%if %{with pgsql} %files pgsql %doc %{rsyslog_docdir}/pgsql-createDB.sql %{_libdir}/rsyslog/ompgsql.so +%endif +%if %{with gssapi} %files gssapi %{_libdir}/rsyslog/lmgssutil.so %{_libdir}/rsyslog/imgssapi.so %{_libdir}/rsyslog/omgssapi.so +%endif +%if %{with relp} %files relp %{_libdir}/rsyslog/imrelp.so %{_libdir}/rsyslog/omrelp.so +%endif +%if %{with gnutls} %files gnutls %{_libdir}/rsyslog/lmnsd_gtls.so +%endif +%if %{with openssl} %files openssl %{_libdir}/rsyslog/lmnsd_ossl.so +%endif +%if %{with snmp} %files snmp %{_libdir}/rsyslog/omsnmp.so +%endif +%if %{with udpspoof} %files udpspoof %{_libdir}/rsyslog/omudpspoof.so +%endif +%if %{with omamqp1} %files omamqp1 %{_libdir}/rsyslog/omamqp1.so +%endif +%if %{with rdkafka} %files kafka %{_libdir}/rsyslog/imkafka.so %{_libdir}/rsyslog/omkafka.so +%endif %files mmkubernetes %{_libdir}/rsyslog/mmkubernetes.so %doc %{rsyslog_docdir}/k8s_filename.rulebase %doc %{rsyslog_docdir}/k8s_container_name.rulebase -%if 0%{?rhel} == 0 +%if %{with hiredis} %files hiredis %{_libdir}/rsyslog/omhiredis.so +%endif +%if %{with libdbi} %files libdbi %{_libdir}/rsyslog/omlibdbi.so +%endif +%if %{with mongodb} %files mongodb %{_bindir}/logctl %{_libdir}/rsyslog/ommongodb.so +%endif +%if %{with rabbitmq} %files rabbitmq %{_libdir}/rsyslog/omrabbitmq.so %endif %changelog +* Mon Oct 20 2025 Attila Lakatos - 8.2510.0-1 +- Rebase to 8.2510.0 + Resolves: rhbz#2404131 +- imjournal open error handling fix + Resolves: rhbz#2375742 +- Add mmleefparse module to base package + +* Fri Sep 05 2025 Attila Lakatos - 8.2508.0-1 +- Rebase to 8.2508.0 + Resolves: rhbz#2392918 + +* Fri Jul 25 2025 Fedora Release Engineering - 8.2506.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Jun 12 2025 Attila Lakatos - 8.2506.0-1 +- Rebase to 8.2506.0 + Resolves: rhbz#2347628 + +* Tue Jan 21 2025 Attila Lakatos - 8.2412.0-3 +- Fix build problem by resolving -Wincompatible-pointer-types error + +* Sat Jan 18 2025 Fedora Release Engineering - 8.2412.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Thu Dec 05 2024 Attila Lakatos - 8.2412.0-1 +- Rebase to 8.2412.0 +- Harden rsyslog service unit +- Disable openssl engines support + Resolves: rhbz#2320050 + +* Fri Oct 04 2024 Attila Lakatos - 8.2408.0-2 +- Rebuild package + Resolves: rhbz#2316361 + +* Wed Aug 21 2024 Attila Lakatos - 8.2408.0-1 +- Rebase to 8.2408.0 + Resolves: rhbz#2266329 + Resolves: rhbz#2301246 + Resolves: rhbz#2305398 + +* Fri Jul 19 2024 Fedora Release Engineering - 8.2312.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed May 29 2024 Orion Poplawski - 8.2312.0-3 +- Explicitly set imjournal FileCreateMode to quiet warning + +* Sat May 11 2024 Kevin Fenzi - 8.2312.0-2 +- rebuild for hiredis soname bump + +* Mon Feb 12 2024 Attila Lakatos - 8.2312.0-1 +- Rebase to 8.2312.0 + resolves: rhbz#2232275 + +* Fri Jan 26 2024 Fedora Release Engineering - 8.2310.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 8.2310.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jan 04 2024 Attila Lakatos - 8.2310.0-2 +- Move rsyslog related logrotate config to the base package + resolves: rhbz#2242243 + +* Fri Aug 25 2023 Attila Lakatos - 8.2310.0-1 +- Rebase to 8.2310.0 + resolves: rhbz#2232275 + +* Wed Aug 16 2023 Stewart Smith - 8.2306.0-4 +- Add mmtaghostname module as a subpackage + +* Fri Jul 21 2023 Fedora Release Engineering - 8.2306.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jul 15 2023 Yaroslav Fedevych - 8.2306.0-2 +- Specify qpid-proton's source as full URL to fix isolated builds + +* Wed Jun 21 2023 Attila Lakatos - 8.2306.0-1 +- rebase to 8.2306.0 + resolves: rhbz#2151339 + resolves: rhbz#2151092 + +* Wed May 10 2023 Todd Zullinger - 8.2210.0-5 +- Use 'systemctl reload' in logrotate script + +* Fri Jan 20 2023 Fedora Release Engineering - 8.2210.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Jan 17 2023 Attila Lakatos - 8.2210.0-3 +- Remove CAP_PERFMON from the capability set +- Add CAP_DAC_OVERRIDE to the capability set + +* Fri Dec 16 2022 Attila Lakatos - 8.2210.0-2 +- Move all if rhel feature conditions to bcond +- Move to bcond: rdkafka, relp, mysql, pgsql, gssapi, gnutls, udpspoof, omamqp1 +- Move to bcond: clickhouse, imdocker, improg + +* Wed Nov 09 2022 Attila Lakatos - 8.2210.0-1 +- rebase to 8.2210.0 + resolves: rhbz#2097173 +- Drop capabilities to the necessary set via libcap-ng + resolves: rhbz#2127403 + * Wed Jul 27 2022 Attila Lakatos - 8.2204.0-3 - Restore default omfile template resolves: rhbz#2088618 diff --git a/sources b/sources index 660b19b..1294997 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (rsyslog-8.2204.0.tar.gz) = d26ab950788b8931b895719f7d8a42509f709b69a76e4188df16f72be050863ee402310ad9300840fed4ac089638497725d67433172778be7b2932fa82210472 -SHA512 (rsyslog-doc-8.2204.0.tar.gz) = 361528b95c1f02cdc2b2ca8ba5252c8215996e81ef1602e08c46be4e1fd8c1c287dd7d52ae9b2b58c0ec7fe38d7079a89e10642ac3f34fe0b6c5737968999fb4 -SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3 +SHA512 (rsyslog-8.2510.0.tar.gz) = d2e693fd8c7112e4ccc36ea6fbb19909df885e7cb2778e95c04b7c5e9db8240224decfee52308a46865b7deffcf1e31ade0104c90d84b768a4dece15e5ea190e +SHA512 (qpid-proton-0.40.0.tar.gz) = 3e7fe56ca1423f45f71d81f5e1d6ec5f21c073cc580628e12a8dbd545a86805b7312834e0d1234dde43797633d575ed639f21a96239b217500cc0a824482aae3 diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/tests/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf new file mode 100644 index 0000000..a90b249 --- /dev/null +++ b/tests/got-audit/main.fmf @@ -0,0 +1,10 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit + diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh new file mode 100755 index 0000000..03761a1 --- /dev/null +++ b/tests/got-audit/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/rsyslog/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlServiceStart rsyslog + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID rsyslog.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore rsyslog + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/main.fmf b/tests/main.fmf new file mode 100644 index 0000000..f225a72 --- /dev/null +++ b/tests/main.fmf @@ -0,0 +1,2 @@ +test: ./runtest.sh +framework: beakerlib