Add mmleefparse module to base package

Resolves: rhbz#2404131
imjournal open error handling fix
Resolves: rhbz#2375742

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -27,3 +27,79 @@ rsyslog-4.6.3.tar.gz
 /rsyslog-8.10.0.tar.gz
 /rsyslog-8.12.0.tar.gz
 /rsyslog-doc-8.12.0.tar.gz
+/rsyslog-8.21.0.tar.gz
+/rsyslog-doc-8.21.0.tar.gz
+/rsyslog-doc-8.22.0.tar.gz
+/rsyslog-8.22.0.tar.gz
+/rsyslog-8.23.0.tar.gz
+/rsyslog-doc-8.23.0.tar.gz
+/rsyslog-8.24.0.tar.gz
+/rsyslog-doc-8.24.0.tar.gz
+/rsyslog-8.25.0.tar.gz
+/rsyslog-doc-8.25.0.tar.gz
+/rsyslog-8.26.0.tar.gz
+/rsyslog-doc-8.26.0.tar.gz
+/rsyslog-doc-8.27.0.tar.gz
+/rsyslog-8.27.0.tar.gz
+/rsyslog-8.29.0.tar.gz
+/rsyslog-doc-8.29.0.tar.gz
+/rsyslog-8.30.0.tar.gz
+/rsyslog-doc-8.30.0.tar.gz
+/rsyslog-8.31.0.tar.gz
+/rsyslog-doc-8.31.0.tar.gz
+/rsyslog-doc-8.32.0.tar.gz
+/rsyslog-8.32.0.tar.gz
+/rsyslog-doc-8.34.0.tar.gz
+/rsyslog-8.34.0.tar.gz
+/rsyslog-8.35.0.tar.gz
+/rsyslog-doc-8.35.0.tar.gz
+/rsyslog-8.36.0.tar.gz
+/rsyslog-doc-8.36.0.tar.gz
+/rsyslog-8.37.0.tar.gz
+/rsyslog-doc-8.37.0.tar.gz
+/rsyslog-8.38.0.tar.gz
+/rsyslog-doc-8.38.0.tar.gz
+/rsyslog-8.39.0.tar.gz
+/rsyslog-doc-8.39.0.tar.gz
+/rsyslog-8.1904.0.tar.gz
+/rsyslog-doc-8.1904.0.tar.gz
+/rsyslog-8.1907.0.tar.gz
+/rsyslog-doc-8.1907.0.tar.gz
+/rsyslog-8.1910.0.tar.gz
+/rsyslog-doc-8.1910.0.tar.gz
+/rsyslog-8.1911.0.tar.gz
+/rsyslog-doc-8.1911.0.tar.gz
+/rsyslog-8.2001.0.tar.gz
+/rsyslog-doc-8.2001.0.tar.gz
+/rsyslog-8.2002.0.tar.gz
+/rsyslog-doc-8.2002.0.tar.gz
+/rsyslog-8.2008.0.tar.gz
+/rsyslog-doc-8.2008.0.tar.gz
+/rsyslog-8.2010.0.tar.gz
+/rsyslog-doc-8.2010.0.tar.gz
+/qpid-proton-0.31.0.tar.gz
+/rsyslog-8.2102.0.tar.gz
+/rsyslog-doc-8.2102.0.tar.gz
+/qpid-proton-0.34.0.tar.gz
+/rsyslog-8.2204.0.tar.gz
+/rsyslog-doc-8.2204.0.tar.gz
+/rsyslog-8.2210.0.tar.gz
+/rsyslog-doc-8.2210.0.tar.gz
+/rsyslog-8.2306.0.tar.gz
+/rsyslog-doc-8.2306.0.tar.gz
+/rsyslog-8.2308.0.tar.gz
+/rsyslog-doc-8.2308.0.tar.gz
+/qpid-proton-0.39.0.tar.gz
+/rsyslog-8.2310.0.tar.gz
+/rsyslog-doc-8.2310.0.tar.gz
+/rsyslog-8.2312.0.tar.gz
+/rsyslog-doc-8.2312.0.tar.gz
+/rsyslog-8.2408.0.tar.gz
+/rsyslog-doc-8.2408.0.tar.gz
+/rsyslog-8.2412.0.tar.gz
+/rsyslog-doc-8.2412.0.tar.gz
+/rsyslog-8.2506.0.tar.gz
+/rsyslog-doc-8.2506.0.tar.gz
+/rsyslog-8.2508.0.tar.gz
+/qpid-proton-0.40.0.tar.gz
+/rsyslog-8.2510.0.tar.gz

plans/main.fmf

@@ -0,0 +1,6 @@
+summary: Run all tests
+execute:
+  how: tmt
+discover:
+  how: fmf
+

rsyslog-8.10.0-imfile-maxlinesatonce.patch

@@ -1,27 +0,0 @@
-From 20912054d062137a35a82962db7e53e1de2b819d Mon Sep 17 00:00:00 2001
-From: Tomas Heinrich <theinric@redhat.com>
-Date: Tue, 23 Jun 2015 13:48:43 +0200
-Subject: [PATCH 3/4] imfile: fix type overflow
-
-Data type of a configuration variable wasn't big enough for
-eCmdHdlrSize.
----
- plugins/imfile/imfile.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/plugins/imfile/imfile.c b/plugins/imfile/imfile.c
-index e3d0884..7e5ec62 100644
---- a/plugins/imfile/imfile.c
-+++ b/plugins/imfile/imfile.c
-@@ -128,7 +128,7 @@ static struct configSettings_s {
- 	int iFacility; /* local0 */
- 	int iSeverity;  /* notice, as of rfc 3164 */
- 	int readMode;  /* mode to use for ReadMultiLine call */
--	int maxLinesAtOnce;	/* how many lines to process in a row? */
-+	int64 maxLinesAtOnce;	/* how many lines to process in a row? */
- 	ruleset_t *pBindRuleset;	/* ruleset to bind listener to (use system default if unspecified) */
- } cs;
- 
--- 
-1.9.3
-

rsyslog-8.10.0-imjournal-empty-messages.patch

@@ -1,40 +0,0 @@
-From f1f77872ab6e962fcc7f53c0b51ef7b2d331c1bf Mon Sep 17 00:00:00 2001
-From: Tomas Heinrich <theinric@redhat.com>
-Date: Tue, 23 Jun 2015 18:09:52 +0200
-Subject: [PATCH 1/4] imjournal: don't sanitize empty messages
-
-It is an error to pass an empty message to
-parser.SanitizeMsg() and doing so could crash the daemon. Besides,
-there's no point in doing so in the first place.
----
- plugins/imjournal/imjournal.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
-index b5866e8..6ad9fca 100644
---- a/plugins/imjournal/imjournal.c
-+++ b/plugins/imjournal/imjournal.c
-@@ -176,6 +176,7 @@ enqMsg(uchar *msg, uchar *pszTag, int iFacility, int iSeverity, struct timeval *
- {
- 	struct syslogTime st;
- 	msg_t *pMsg;
-+	size_t len;
- 	DEFiRet;
- 
- 	assert(msg != NULL);
-@@ -189,8 +190,10 @@ enqMsg(uchar *msg, uchar *pszTag, int iFacility, int iSeverity, struct timeval *
- 	}
- 	MsgSetFlowControlType(pMsg, eFLOWCTL_LIGHT_DELAY);
- 	MsgSetInputName(pMsg, pInputName);
--	MsgSetRawMsgWOSize(pMsg, (char*)msg);
--	parser.SanitizeMsg(pMsg);
-+	len = strlen((char*)msg);
-+	MsgSetRawMsg(pMsg, (char*)msg, len);
-+	if(len > 0)
-+		parser.SanitizeMsg(pMsg);
- 	MsgSetMSGoffs(pMsg, 0);	/* we do not have a header... */
- 	MsgSetRcvFrom(pMsg, glbl.GetLocalHostNameProp());
- 	MsgSetRcvFromIP(pMsg, pLocalHostIP);
--- 
-1.9.3
-

rsyslog-8.10.0-resetconfigvariables.patch

@@ -1,99 +0,0 @@
-From 4f6456f536076b32802959506389cf69f2b08d03 Mon Sep 17 00:00:00 2001
-From: Tomas Heinrich <theinric@redhat.com>
-Date: Thu, 25 Jun 2015 18:20:54 +0200
-Subject: [PATCH 2/4] Harmonize resetConfigVariables values and defaults
-
-Default values for several global and main message queue parameters
-were defined in two places which, over time, became inconsistent.
-This merges the code used in resetConfigVariables and the rsconf_t
-constructor. In cases where values for the same parameter differed,
-the value with a more recent commit timestamp was used.
----
- runtime/rsconf.c | 49 ++++++++++++++++---------------------------------
- 1 file changed, 16 insertions(+), 33 deletions(-)
-
-diff --git a/runtime/rsconf.c b/runtime/rsconf.c
-index d6e0bdf..c5b6132 100644
---- a/runtime/rsconf.c
-+++ b/runtime/rsconf.c
-@@ -122,9 +122,10 @@ static struct cnfparamblk parserpblk =
- /* forward-definitions */
- void cnfDoCfsysline(char *ln);
- 
--/* Standard-Constructor
-- */
--BEGINobjConstruct(rsconf) /* be sure to specify the object type also in END macro! */
-+void cnfSetDefaults(rsconf_t *pThis)
-+{
-+	pThis->globals.bAbortOnUncleanConfig = 0;
-+	pThis->globals.bReduceRepeatMsgs = 0;
- 	pThis->globals.bDebugPrintTemplateList = 1;
- 	pThis->globals.bDebugPrintModuleList = 0;
- 	pThis->globals.bDebugPrintCfSysLineHandlerList = 0;
-@@ -135,9 +136,6 @@ BEGINobjConstruct(rsconf) /* be sure to specify the object type also in END macr
- 	pThis->templates.last = NULL;
- 	pThis->templates.lastStatic = NULL;
- 	pThis->actions.nbrActions = 0;
--	lookupInitCnf(&pThis->lu_tabs);
--	CHKiRet(llInit(&pThis->rulesets.llRulesets, rulesetDestructForLinkedList,
--			rulesetKeyDestruct, strcasecmp));
- 	/* queue params */
- 	pThis->globals.mainQ.iMainMsgQueueSize = 100000;
- 	pThis->globals.mainQ.iMainMsgQHighWtrMark = 80000;
-@@ -161,7 +159,16 @@ BEGINobjConstruct(rsconf) /* be sure to specify the object type also in END macr
- 	pThis->globals.mainQ.bMainMsgQSaveOnShutdown = 1;
- 	pThis->globals.mainQ.iMainMsgQueueDeqtWinFromHr = 0;
- 	pThis->globals.mainQ.iMainMsgQueueDeqtWinToHr = 25;
--	/* end queue params */
-+}
-+
-+
-+/* Standard-Constructor
-+ */
-+BEGINobjConstruct(rsconf) /* be sure to specify the object type also in END macro! */
-+	cnfSetDefaults(pThis);
-+	lookupInitCnf(&pThis->lu_tabs);
-+	CHKiRet(llInit(&pThis->rulesets.llRulesets, rulesetDestructForLinkedList,
-+			rulesetKeyDestruct, strcasecmp));
- finalize_it:
- ENDobjConstruct(rsconf)
- 
-@@ -967,33 +974,9 @@ finalize_it:
- /* legacy config system: reset config variables to default values.  */
- static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal)
- {
--	loadConf->globals.bLogStatusMsgs = DFLT_bLogStatusMsgs;
--	loadConf->globals.bDebugPrintTemplateList = 1;
--	loadConf->globals.bDebugPrintCfSysLineHandlerList = 1;
--	loadConf->globals.bDebugPrintModuleList = 1;
--	loadConf->globals.bAbortOnUncleanConfig = 0;
--	loadConf->globals.bReduceRepeatMsgs = 0;
- 	free(loadConf->globals.mainQ.pszMainMsgQFName);
--	loadConf->globals.mainQ.pszMainMsgQFName = NULL;
--	loadConf->globals.mainQ.iMainMsgQueueSize = 10000;
--	loadConf->globals.mainQ.iMainMsgQHighWtrMark = 8000;
--	loadConf->globals.mainQ.iMainMsgQLowWtrMark = 2000;
--	loadConf->globals.mainQ.iMainMsgQDiscardMark = 9800;
--	loadConf->globals.mainQ.iMainMsgQDiscardSeverity = 8;
--	loadConf->globals.mainQ.iMainMsgQueMaxFileSize = 1024 * 1024;
--	loadConf->globals.mainQ.iMainMsgQueueNumWorkers = 1;
--	loadConf->globals.mainQ.iMainMsgQPersistUpdCnt = 0;
--	loadConf->globals.mainQ.bMainMsgQSyncQeueFiles = 0;
--	loadConf->globals.mainQ.iMainMsgQtoQShutdown = 1500;
--	loadConf->globals.mainQ.iMainMsgQtoActShutdown = 1000;
--	loadConf->globals.mainQ.iMainMsgQtoEnq = 2000;
--	loadConf->globals.mainQ.iMainMsgQtoWrkShutdown = 60000;
--	loadConf->globals.mainQ.iMainMsgQWrkMinMsgs = 100;
--	loadConf->globals.mainQ.iMainMsgQDeqSlowdown = 0;
--	loadConf->globals.mainQ.bMainMsgQSaveOnShutdown = 1;
--	loadConf->globals.mainQ.MainMsgQueType = QUEUETYPE_FIXED_ARRAY;
--	loadConf->globals.mainQ.iMainMsgQueMaxDiskSpace = 0;
--	loadConf->globals.mainQ.iMainMsgQueDeqBatchSize = 32;
-+
-+	cnfSetDefaults(loadConf);
- 
- 	return RS_RET_OK;
- }
--- 
-1.9.3
-

rsyslog-8.12.0-gnutls-detection.patch

@@ -1,24 +0,0 @@
-diff -up ./configure.ac.fix ./configure.ac
---- ./configure.ac.fix	2015-08-10 12:25:41.000000000 +0200
-+++ ./configure.ac	2015-08-31 10:35:18.515110190 +0200
-@@ -763,17 +763,11 @@ AC_ARG_ENABLE(gnutls,
- if test "x$enable_gnutls" = "xyes"; then
- 	PKG_CHECK_MODULES(GNUTLS, gnutls >= 1.4.0)
- 	AC_DEFINE([ENABLE_GNUTLS], [1], [Indicator that GnuTLS is present])
--	AC_CHECK_LIB(
--	    [gnutls],
--	    [gnutls_global_init],
--	    [
--	     AC_DEFINE(HAVE_LIB_GNUTLS, 1, [gnutls is available])
--	    ],
--	    [AC_MSG_WARN([gnutls_global_init function missing or not detected])],
--	    []
--	)
-+	save_libs=$LIBS
-+	LIBS="$LIBS $GNUTLS_LIBS"
- 	AC_CHECK_FUNCS(gnutls_certificate_set_retrieve_function,,)
- 	AC_CHECK_FUNCS(gnutls_certificate_type_set_priority,,)
-+	LIBS=$save_libs	
- fi
- AM_CONDITIONAL(ENABLE_GNUTLS, test x$enable_gnutls = xyes)
- 

rsyslog-8.8.0-imjournal-dflt-pri.patch

@@ -1,27 +0,0 @@
-From f88f5d4f7e57a6f41b01d4e06f8d40dee4c0dbad Mon Sep 17 00:00:00 2001
-From: Tomas Heinrich <theinric@redhat.com>
-Date: Fri, 20 Mar 2015 18:17:05 +0100
-Subject: [PATCH] imjournal: fix default message priority
-
----
- plugins/imjournal/imjournal.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
-index 7c2c2fa..b5866e8 100644
---- a/plugins/imjournal/imjournal.c
-+++ b/plugins/imjournal/imjournal.c
-@@ -97,8 +97,8 @@ static struct cnfparamblk modpblk =
- 	};
- 
- #define DFLT_persiststateinterval 10
--#define DFLT_SEVERITY pri2fac(LOG_NOTICE)
--#define DFLT_FACILITY pri2sev(LOG_USER)
-+#define DFLT_SEVERITY pri2sev(LOG_NOTICE)
-+#define DFLT_FACILITY pri2fac(LOG_USER)
- 
- static int bLegacyCnfModGlobalsPermitted = 1;/* are legacy module-global config parameters permitted? */
- 
--- 
-1.9.3
-

rsyslog-8.8.0-immutable-json-props.patch

@@ -1,32 +0,0 @@
-diff -up ./runtime/msg.c.orig ./runtime/msg.c
---- a/runtime/msg.c	2015-01-15 19:30:02.351699869 +0100
-+++ b/runtime/msg.c	2015-01-15 19:35:58.667176642 +0100
-@@ -4267,22 +4267,19 @@ jsonPathFindParent(struct json_object *j
- 	RETiRet;
- }
- 
-+/* In case of duplicate names, the original value is kept. */
- static rsRetVal
- jsonMerge(struct json_object *existing, struct json_object *json)
- {
--	/* TODO: check & handle duplicate names */
- 	DEFiRet;
- 	struct json_object_iter it;
- 
--	json_object_object_foreachC(json, it) {
--		json_object_object_add(existing, it.key,
--			json_object_get(it.val));
-+	json_object_object_foreachC(existing, it) {
-+		json_object_object_add(json, it.key, json_object_get(it.val));
- 	}
--	/* note: json-c does ref counting. We added all descandants refcounts
--	 * in the loop above. So when we now free(_put) the root object, only
--	 * root gets freed().
--	 */
--	json_object_put(json);
-+
-+	iRet = jsonMerge(existing, json);
-+
- 	RETiRet;
- }
- 

rsyslog-8.8.0-missing-test-data.patch

@@ -1,45 +0,0 @@
-From e07210a7eb47df978b958d1489b91084732fdd47 Mon Sep 17 00:00:00 2001
-From: Tomas Heinrich <theinric@redhat.com>
-Date: Sun, 15 Mar 2015 16:25:33 +0100
-Subject: [PATCH] Add missing test data
-
----
- tests/testsuites/mmnormalize_regex.rulebase     | 1 +
- tests/testsuites/mmnormalize_tokenized.rulebase | 5 +++++
- tests/testsuites/mmnormalize_variable.rulebase  | 1 +
- 3 files changed, 7 insertions(+)
- create mode 100644 tests/testsuites/mmnormalize_regex.rulebase
- create mode 100644 tests/testsuites/mmnormalize_tokenized.rulebase
- create mode 100644 tests/testsuites/mmnormalize_variable.rulebase
-
-diff --git a/tests/testsuites/mmnormalize_regex.rulebase b/tests/testsuites/mmnormalize_regex.rulebase
-new file mode 100644
-index 0000000..f58e8f2
---- /dev/null
-+++ b/tests/testsuites/mmnormalize_regex.rulebase
-@@ -0,0 +1 @@
-+rule=:http host ports are %hps:regex:([0-9.\x3a]+(, )?)+% etc
-\ No newline at end of file
-diff --git a/tests/testsuites/mmnormalize_tokenized.rulebase b/tests/testsuites/mmnormalize_tokenized.rulebase
-new file mode 100644
-index 0000000..da5242d
---- /dev/null
-+++ b/tests/testsuites/mmnormalize_tokenized.rulebase
-@@ -0,0 +1,5 @@
-+rule=only_ips:%only_ips:tokenized:, :ipv4%
-+rule=local_ips:local ips are %local_ips:tokenized:, :ipv4%
-+rule=external_ips:%external_ips:tokenized:, :ipv4% are external ips
-+rule=paths:for %user:char-to:@%@localhost path was %fragments:tokenized:\x3a:char-sep:\x3a%
-+rule=recur_comma_colon_nos:comma separated list of colon separated numbers: %some_nos:tokenized:, :tokenized: \x3a :tokenized:#:number%
-\ No newline at end of file
-diff --git a/tests/testsuites/mmnormalize_variable.rulebase b/tests/testsuites/mmnormalize_variable.rulebase
-new file mode 100644
-index 0000000..4d40d4c
---- /dev/null
-+++ b/tests/testsuites/mmnormalize_variable.rulebase
-@@ -0,0 +1 @@
-+rule=hms:%hr:number%:%min:number%:%sec:number% %zone:word%
-\ No newline at end of file
--- 
-1.9.3
-

rsyslog-8.8.0-sd-service.patch

@@ -1,14 +0,0 @@
-diff -up rsyslog-7.4.1/rsyslog.service.in.orig rsyslog-7.4.1/rsyslog.service.in
---- rsyslog-7.4.1/rsyslog.service.in.orig	2013-06-17 15:28:54.430023493 +0200
-+++ rsyslog-7.4.1/rsyslog.service.in	2013-06-17 15:30:05.874378084 +0200
-@@ -6,7 +6,9 @@ Requires=syslog.socket
- 
- [Service]
- Type=notify
--ExecStart=@sbindir@/rsyslogd -n
-+EnvironmentFile=-/etc/sysconfig/rsyslog
-+ExecStart=@sbindir@/rsyslogd -n $SYSLOGD_OPTIONS
-+UMask=0066
- StandardOutput=null
- Restart=on-failure
- 

rsyslog.conf

@@ -1,52 +1,42 @@
 # rsyslog configuration file
 
 # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
+# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html 
 # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
 
-#### MODULES ####
-
-# The imjournal module bellow is now used as a message source instead of imuxsock.
-$ModLoad imjournal # provides access to the systemd journal
-#$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
-#$ModLoad immark  # provides --MARK-- message capability
-
-# Provides UDP syslog reception
-#$ModLoad imudp
-#$UDPServerRun 514
-
-# Provides TCP syslog reception
-#$ModLoad imtcp
-#$InputTCPServerRun 514
-
-# By default, all system logs are read from journald through the
-# imjournal module. To read messages from the syslog socket, the
-# imuxsock module has to be loaded and a path to the socket specified.
-#$ModLoad imuxsock
-# The default path to the syslog socket provided by journald:
-#$SystemLogSocketName /run/systemd/journal/syslog
-
-
 #### GLOBAL DIRECTIVES ####
 
 # Where to place auxiliary files
-$WorkDirectory /var/lib/rsyslog
+global(workDirectory="/var/lib/rsyslog")
+
+#### MODULES ####
 
 # Use default timestamp format
-$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
 
-# File syncing capability is disabled by default. This feature is usually not required,
-# not useful and an extreme performance hit
-#$ActionFileEnableSync on
+module(load="imuxsock"    # provides support for local system logging (e.g. via logger command)
+       SysSock.Use="off") # Turn off message reception via local log socket; 
+                          # local messages are retrieved through imjournal now.
+module(load="imjournal"             # provides access to the systemd journal
+       FileCreateMode="0600"        # Quiet warning and ensure privacy
+       UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from
+       StateFile="imjournal.state") # File to store the position in the journal
 
 # Include all config files in /etc/rsyslog.d/
-$IncludeConfig /etc/rsyslog.d/*.conf
+include(file="/etc/rsyslog.d/*.conf" mode="optional")
 
-# File to store the position in the journal
-$IMJournalStateFile imjournal.state
-# If there is no saved state yet, don't read in the whole bulk of messages.
-# This means some of the older messages won't be collected by rsyslog,
-# but it also prevents a potential huge spike in resource utilization.
-$IMJournalIgnorePreviousMessages on
+#module(load="imklog") # reads kernel messages (the same are read from journald)
+#module(load="immark") # provides --MARK-- message capability
+
+# Provides UDP syslog reception
+# for parameters see http://www.rsyslog.com/doc/imudp.html
+#module(load="imudp") # needs to be done just once
+#input(type="imudp" port="514")
+
+# Provides TCP syslog reception
+# for parameters see http://www.rsyslog.com/doc/imtcp.html
+#module(load="imtcp") # needs to be done just once
+#input(type="imtcp" port="514")
 
 #### RULES ####
 
@@ -78,19 +68,15 @@ uucp,news.crit                                          /var/log/spooler
 local7.*                                                /var/log/boot.log
 
 
-# ### begin forwarding rule ###
-# The statement between the begin ... end define a SINGLE forwarding
-# rule. They belong together, do NOT split them. If you create multiple
-# forwarding rules, duplicate the whole block!
-# Remote Logging (we use TCP for reliable delivery)
-#
-# An on-disk queue is created for this action. If the remote host is
-# down, messages are spooled to disk and sent when it is up again.
-#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
-#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
-#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
-#$ActionQueueType LinkedList   # run asynchronously
-#$ActionResumeRetryCount -1    # infinite retries if host is down
-# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
-#*.* @@remote-host:514
-# ### end of the forwarding rule ###
+# ### sample forwarding rule ###
+#action(type="omfwd"  
+# # An on-disk queue is created for this action. If the remote host is
+# # down, messages are spooled to disk and sent when it is up again.
+#queue.filename="fwdRule1"       # unique name prefix for spool files
+#queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)
+#queue.saveonshutdown="on"       # save messages to disk on shutdown
+#queue.type="LinkedList"         # run asynchronously
+#action.resumeRetryCount="-1"    # infinite retries if host is down
+# # Remote Logging (we use TCP for reliable delivery)
+# # remote_host is: name/ip, e.g. 192.168.0.1, port optional e.g. 10514
+#Target="remote_host" Port="XXX" Protocol="tcp")

rsyslog.log

@@ -7,6 +7,6 @@
     missingok
     sharedscripts
     postrotate
-        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
+        /usr/bin/systemctl reload rsyslog.service >/dev/null 2>&1 || true
     endscript
 }

rsyslog.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=System Logging Service
+;Requires=syslog.socket
+Documentation=man:rsyslogd(8)
+Documentation=https://www.rsyslog.com/doc/
+Wants=network.target network-online.target
+After=network.target network-online.target
+
+[Service]
+Type=notify
+EnvironmentFile=-/etc/sysconfig/rsyslog
+ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS
+ExecReload=/usr/bin/kill -HUP $MAINPID
+UMask=0066
+StandardOutput=null
+Restart=on-failure
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=net
+NoNewPrivileges=yes
+ProtectControlGroups=yes
+ProtectHome=read-only
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+
+
+# Increase the default a bit in order to allow many simultaneous
+# files to be monitored, we might need a lot of fds.
+LimitNOFILE=16384
+
+[Install]
+WantedBy=multi-user.target
+;Alias=syslog.service

sources

@@ -1,2 +1,2 @@
-c31c2d545c8a3b8695bdf076851d1517  rsyslog-8.12.0.tar.gz
-8ec9d7a060450e92119bbf0dd28b624e  rsyslog-doc-8.12.0.tar.gz
+SHA512 (rsyslog-8.2510.0.tar.gz) = d2e693fd8c7112e4ccc36ea6fbb19909df885e7cb2778e95c04b7c5e9db8240224decfee52308a46865b7deffcf1e31ade0104c90d84b768a4dece15e5ea190e
+SHA512 (qpid-proton-0.40.0.tar.gz) = 3e7fe56ca1423f45f71d81f5e1d6ec5f21c073cc580628e12a8dbd545a86805b7312834e0d1234dde43797633d575ed639f21a96239b217500cc0a824482aae3

tests/got-audit/got-audit.gdb

@@ -0,0 +1,2 @@
+gef config gef.disable_color True
+got-audit --all

tests/got-audit/main.fmf

@@ -0,0 +1,10 @@
+summary: Audit the GOT for signs of tampering
+description: |
+  Pointers in the server process GOT will be checked to ensure that
+  each function pointer's value is within a shared object file
+  that exports a symbol of that name, and that no shared object
+  files export conflicting symbols.
+contact: Gordon Messmer <gordon.messmer@gmail.com>
+require+:
+  - gdb-gef           # needed to test got-audit
+

tests/got-audit/runtest.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/rsyslog/Sanity/got-audit
+#   Description: Check pointers in the server process GOT for signs of tampering
+#   Author: Gordon Messmer <gordon.messmer@gmail.com>
+#
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlServiceStart rsyslog
+        rlRun "TestDir=\$(pwd)"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Run GEF got-audit"
+        rlRun "SERVICE_PID=\$( systemctl show --property=MainPID rsyslog.service | cut -f2 -d= )"
+        rlRun "echo SERVICE_PID is '$SERVICE_PID'"
+        [ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
+        rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
+        # Basic test: ensure that at least one symbol is found in libc.so,
+        #  to verify that the report looks plausible.
+        rlAssertGrep " : /.*/libc.so" "$auditfile"
+        # Ensure the got-audit did not report any errors
+        rlAssertNotGrep " :: ERROR" "$auditfile"
+        rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlServiceRestore rsyslog
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

tests/main.fmf

@@ -0,0 +1,2 @@
+test: ./runtest.sh
+framework: beakerlib