Skip to content
Snippets Groups Projects
Commit df577df7 authored by Rocky Automation's avatar Rocky Automation :tv:
Browse files

import aide-0.16-8.el8

parent c11a506e
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
SOURCES/aide.conf
+ 116
− 210
View file @ df577df7
...@@ -51,6 +51,8 @@ report_url=stdout ...@@ -51,6 +51,8 @@ report_url=stdout
#crc32: crc32 checksum (MHASH only) #crc32: crc32 checksum (MHASH only)
#whirlpool: whirlpool checksum (MHASH only) #whirlpool: whirlpool checksum (MHASH only)
FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
#R: p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5 #R: p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
#L: p+i+n+u+g+acl+selinux+xattrs #L: p+i+n+u+g+acl+selinux+xattrs
#E: Empty group #E: Empty group
...@@ -63,245 +65,150 @@ ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger ...@@ -63,245 +65,150 @@ ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
# Everything but access time (Ie. all changes) # Everything but access time (Ie. all changes)
EVERYTHING = R+ALLXTRAHASHES EVERYTHING = R+ALLXTRAHASHES
# Sane # Sane, with multiple hashes
# NORMAL = R+sha512 # NORMAL = R+rmd160+sha256+whirlpool
NORMAL = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha512 NORMAL = FIPSR+sha512
# For directories, don't bother doing hashes # For directories, don't bother doing hashes
DIR = p+i+n+u+g+acl+selinux+xattrs DIR = p+i+n+u+g+acl+selinux+xattrs
# Access control only # Access control only
PERMS = p+u+g+acl+selinux+xattrs PERMS = p+i+u+g+acl+selinux
# Logfile are special, in that they often change # Logfile are special, in that they often change
LOG = p+u+g+n+S+acl+selinux+xattrs LOG = >
# Content + file type.
CONTENT = sha512+ftype
# Extended content + file type + access. # Just do sha256 and sha512 hashes
CONTENT_EX = sha512+ftype+p+u+g+n+acl+selinux+xattrs LSPP = FIPSR+sha512
# Some files get updated automatically, so the inode/ctime/mtime change # Some files get updated automatically, so the inode/ctime/mtime change
# but we want to know when the data inside them changes # but we want to know when the data inside them changes
DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha512 DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha256
# Next decide what directories/files you want in the database. # Next decide what directories/files you want in the database.
/boot CONTENT_EX /boot NORMAL
/opt CONTENT /bin NORMAL
/sbin NORMAL
# Admins dot files constantly change, just check perms /lib NORMAL
/root/\..* PERMS /lib64 NORMAL
# Otherwise get all of /root. /opt NORMAL
/root CONTENT_EX /usr NORMAL
/root NORMAL
# These are too volatile # These are too volatile
!/usr/src !/usr/src
!/usr/tmp !/usr/tmp
# Otherwise get all of /usr. # Check only permissions, inode, user and group for /etc, but
/usr CONTENT_EX # cover some important files closely.
/etc PERMS
# trusted databases !/etc/mtab
/etc/hosts$ CONTENT_EX # Ignore backup files
/etc/host.conf$ CONTENT_EX !/etc/.*~
/etc/hostname$ CONTENT_EX /etc/exports NORMAL
/etc/issue$ CONTENT_EX /etc/fstab NORMAL
/etc/issue.net$ CONTENT_EX /etc/passwd NORMAL
/etc/protocols$ CONTENT_EX /etc/group NORMAL
/etc/services$ CONTENT_EX /etc/gshadow NORMAL
/etc/localtime$ CONTENT_EX /etc/shadow NORMAL
/etc/alternatives CONTENT_EX /etc/security/opasswd NORMAL
/etc/sysconfig CONTENT_EX
/etc/mime.types$ CONTENT_EX /etc/hosts.allow NORMAL
/etc/terminfo CONTENT_EX /etc/hosts.deny NORMAL
/etc/exports$ CONTENT_EX
/etc/fstab$ CONTENT_EX /etc/sudoers NORMAL
/etc/passwd$ CONTENT_EX /etc/skel NORMAL
/etc/group$ CONTENT_EX
/etc/gshadow$ CONTENT_EX /etc/logrotate.d NORMAL
/etc/shadow$ CONTENT_EX
/etc/subgid$ CONTENT_EX /etc/resolv.conf DATAONLY
/etc/subuid$ CONTENT_EX
/etc/security/opasswd$ CONTENT_EX /etc/nscd.conf NORMAL
/etc/skel CONTENT_EX /etc/securetty NORMAL
/etc/subuid$ CONTENT_EX
/etc/subgid$ CONTENT_EX # Shell/X starting files
/etc/sssd CONTENT_EX /etc/profile NORMAL
/etc/machine-id$ CONTENT_EX /etc/bashrc NORMAL
/etc/swid CONTENT_EX /etc/bash_completion.d/ NORMAL
/etc/system-release-cpe$ CONTENT_EX /etc/login.defs NORMAL
/etc/shells$ CONTENT_EX /etc/zprofile NORMAL
/etc/tmux.conf$ CONTENT_EX /etc/zshrc NORMAL
/etc/xattr.conf$ CONTENT_EX /etc/zlogin NORMAL
/etc/zlogout NORMAL
/etc/profile.d/ NORMAL
# networking /etc/X11/ NORMAL
/etc/hosts.allow$ CONTENT_EX
/etc/hosts.deny$ CONTENT_EX
/etc/firewalld CONTENT_EX
!/etc/NetworkManager/system-connections
/etc/NetworkManager CONTENT_EX
/etc/networks$ CONTENT_EX
/etc/dhcp CONTENT_EX
/etc/wpa_supplicant CONTENT_EX
/etc/resolv.conf$ DATAONLY
/etc/nscd.conf$ CONTENT_EX
# logins and accounts
/etc/login.defs$ CONTENT_EX
/etc/libuser.conf$ CONTENT_EX
/var/log/faillog$ PERMS
/var/log/lastlog$ PERMS
/var/run/faillock PERMS
/etc/pam.d CONTENT_EX
/etc/security CONTENT_EX
/etc/securetty$ CONTENT_EX
/etc/polkit-1 CONTENT_EX
/etc/sudo.conf$ CONTENT_EX
/etc/sudoers$ CONTENT_EX
/etc/sudoers.d CONTENT_EX
# Shell/X startup files
/etc/profile$ CONTENT_EX
/etc/profile.d CONTENT_EX
/etc/bashrc$ CONTENT_EX
/etc/bash_completion.d CONTENT_EX
/etc/zprofile$ CONTENT_EX
/etc/zshrc$ CONTENT_EX
/etc/zlogin$ CONTENT_EX
/etc/zlogout$ CONTENT_EX
/etc/X11 CONTENT_EX
# Pkg manager # Pkg manager
/etc/dnf CONTENT_EX /etc/yum.conf NORMAL
/etc/yum.conf$ CONTENT_EX /etc/yumex.conf NORMAL
/etc/yum CONTENT_EX /etc/yumex.profiles.conf NORMAL
/etc/yum.repos.d CONTENT_EX /etc/yum/ NORMAL
/etc/yum.repos.d/ NORMAL
/var/log LOG
/var/run/utmp LOG
# This gets new/removes-old filenames daily # This gets new/removes-old filenames daily
!/var/log/sa !/var/log/sa
# As we are checking it, we've truncated yesterdays size to zero. # As we are checking it, we've truncated yesterdays size to zero.
!/var/log/aide.log !/var/log/aide.log
# auditing # LSPP rules...
# AIDE produces an audit record, so this becomes perpetual motion. # AIDE produces an audit record, so this becomes perpetual motion.
/var/log/audit PERMS # /var/log/audit/ LSPP
/etc/audit CONTENT_EX /etc/audit/ LSPP
/etc/libaudit.conf$ CONTENT_EX /etc/libaudit.conf LSPP
/etc/aide.conf$ CONTENT_EX /usr/sbin/stunnel LSPP
/var/spool/at LSPP
# System logs /etc/at.allow LSPP
/etc/rsyslog.conf$ CONTENT_EX /etc/at.deny LSPP
/etc/rsyslog.d CONTENT_EX /etc/cron.allow LSPP
/etc/logrotate.conf$ CONTENT_EX /etc/cron.deny LSPP
/etc/logrotate.d CONTENT_EX /etc/cron.d/ LSPP
/etc/systemd/journald.conf$ CONTENT_EX /etc/cron.daily/ LSPP
/var/log LOG+ANF+ARF /etc/cron.hourly/ LSPP
/var/run/utmp LOG /etc/cron.monthly/ LSPP
/etc/cron.weekly/ LSPP
/etc/crontab LSPP
/var/spool/cron/root LSPP
# secrets /etc/login.defs LSPP
/etc/pkcs11 CONTENT_EX /etc/securetty LSPP
/etc/pki CONTENT_EX /var/log/faillog LSPP
/etc/crypto-policies CONTENT_EX /var/log/lastlog LSPP
/etc/certmonger CONTENT_EX
/var/lib/systemd/random-seed$ PERMS
# init system
/etc/systemd CONTENT_EX
/etc/rc.d CONTENT_EX
/etc/tmpfiles.d CONTENT_EX
# boot config
/etc/default CONTENT_EX
/etc/grub.d CONTENT_EX
/etc/dracut.conf$ CONTENT_EX
/etc/dracut.conf.d CONTENT_EX
# glibc linker
/etc/ld.so.cache$ CONTENT_EX
/etc/ld.so.conf$ CONTENT_EX
/etc/ld.so.conf.d CONTENT_EX
/etc/ld.so.preload$ CONTENT_EX
# kernel config
/etc/sysctl.conf$ CONTENT_EX
/etc/sysctl.d CONTENT_EX
/etc/modprobe.d CONTENT_EX
/etc/modules-load.d CONTENT_EX
/etc/depmod.d CONTENT_EX
/etc/udev CONTENT_EX
/etc/crypttab$ CONTENT_EX
#### Daemons ####
# cron jobs
/var/spool/at CONTENT
/etc/at.allow$ CONTENT
/etc/at.deny$ CONTENT
/var/spool/anacron CONTENT
/etc/anacrontab$ CONTENT_EX
/etc/cron.allow$ CONTENT_EX
/etc/cron.deny$ CONTENT_EX
/etc/cron.d CONTENT_EX
/etc/cron.daily CONTENT_EX
/etc/cron.hourly CONTENT_EX
/etc/cron.monthly CONTENT_EX
/etc/cron.weekly CONTENT_EX
/etc/crontab$ CONTENT_EX
/var/spool/cron/root CONTENT
# time keeping
/etc/chrony.conf$ CONTENT_EX
/etc/chrony.keys$ CONTENT_EX
# mail
/etc/aliases$ CONTENT_EX
/etc/aliases.db$ CONTENT_EX
/etc/postfix CONTENT_EX
# ssh
/etc/ssh/sshd_config$ CONTENT_EX
/etc/ssh/ssh_config$ CONTENT_EX
# stunnel
/etc/stunnel CONTENT_EX
# printing
/etc/cups CONTENT_EX
/etc/cupshelpers CONTENT_EX
/etc/avahi CONTENT_EX
# web server
/etc/httpd CONTENT_EX
# dns
/etc/named CONTENT_EX
/etc/named.conf$ CONTENT_EX
/etc/named.iscdlv.key$ CONTENT_EX
/etc/named.rfc1912.zones$ CONTENT_EX
/etc/named.root.key$ CONTENT_EX
# xinetd
/etc/xinetd.conf$ CONTENT_EX
/etc/xinetd.d CONTENT_EX
# IPsec
/etc/ipsec.conf$ CONTENT_EX
/etc/ipsec.secrets$ CONTENT_EX
/etc/ipsec.d CONTENT_EX
# USB guard
/etc/usbguard CONTENT_EX
# Ignore some files
!/etc/mtab$
!/etc/.*~
# Now everything else /etc/hosts LSPP
/etc PERMS /etc/sysconfig LSPP
/etc/inittab LSPP
/etc/grub/ LSPP
/etc/rc.d LSPP
/etc/ld.so.conf LSPP
/etc/localtime LSPP
/etc/sysctl.conf LSPP
/etc/modprobe.conf LSPP
/etc/pam.d LSPP
/etc/security LSPP
/etc/aliases LSPP
/etc/postfix LSPP
/etc/ssh/sshd_config LSPP
/etc/ssh/ssh_config LSPP
/etc/stunnel LSPP
/etc/vsftpd.ftpusers LSPP
/etc/vsftpd LSPP
/etc/issue LSPP
/etc/issue.net LSPP
/etc/cups LSPP
# With AIDE's default verbosity level of 5, these would give lots of # With AIDE's default verbosity level of 5, these would give lots of
# warnings upon tree traversal. It might change with future version. # warnings upon tree traversal. It might change with future version.
...@@ -314,4 +221,3 @@ DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha512 ...@@ -314,4 +221,3 @@ DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha512
# Admins dot files constantly change, just check perms # Admins dot files constantly change, just check perms
/root/\..* PERMS /root/\..* PERMS
!/root/.xauth*
SOURCES/coverity.patch
+ 1
− 1
View file @ df577df7
...@@ -241,7 +241,7 @@ diff -up ./src/commandconf.c.coverity ./src/commandconf.c ...@@ -241,7 +241,7 @@ diff -up ./src/commandconf.c.coverity ./src/commandconf.c
} }
} }
- *val++; - *val++;
+ val++; + (*val)++;
} }
} }
#endif #endif
......
SPECS/aide.spec
+ 5
− 37
View file @ df577df7
Summary: Intrusion detection environment Summary: Intrusion detection environment
Name: aide Name: aide
Version: 0.16 Version: 0.16
Release: 14%{?dist} Release: 8%{?dist}
URL: http://sourceforge.net/projects/aide URL: http://sourceforge.net/projects/aide
License: GPLv2+ License: GPLv2+
Source0: %{url}/files/aide/%{version}/%{name}-%{version}.tar.gz Source0: %{url}/files/aide/%{version}/%{name}-%{version}.tar.gz
Source1: aide.conf Source1: aide.conf
Source2: README.quickstart Source2: README.quickstart
...@@ -22,8 +24,6 @@ BuildRequires: libattr-devel ...@@ -22,8 +24,6 @@ BuildRequires: libattr-devel
BuildRequires: e2fsprogs-devel BuildRequires: e2fsprogs-devel
Buildrequires: audit-libs-devel Buildrequires: audit-libs-devel
Requires: libgcrypt >= 1.8.5
# Customize the database file location in the man page. # Customize the database file location in the man page.
Patch1: aide-0.16rc1-man.patch Patch1: aide-0.16rc1-man.patch
# fix aide in FIPS mode # fix aide in FIPS mode
...@@ -34,9 +34,6 @@ Patch4: aide-0.16-crypto-disable-haval-and-others.patch ...@@ -34,9 +34,6 @@ Patch4: aide-0.16-crypto-disable-haval-and-others.patch
Patch5: coverity.patch Patch5: coverity.patch
Patch6: aide-0.16-crash-elf.patch Patch6: aide-0.16-crash-elf.patch
# 1676487 - Null pointer dereference fix spotted by coverity
Patch7: coverity2.patch
%description %description
AIDE (Advanced Intrusion Detection Environment) is a file integrity AIDE (Advanced Intrusion Detection Environment) is a file integrity
checker and intrusion detection program. checker and intrusion detection program.
...@@ -81,36 +78,6 @@ mkdir -p -m0700 %{buildroot}%{_localstatedir}/lib/aide ...@@ -81,36 +78,6 @@ mkdir -p -m0700 %{buildroot}%{_localstatedir}/lib/aide
%dir %attr(0700,root,root) %{_localstatedir}/log/aide %dir %attr(0700,root,root) %{_localstatedir}/log/aide
%changelog %changelog
* Tue Jun 30 2020 Radovan Sroka <rsroka@redhat.com> = 0.16.14
- strict require for libgcrypt
resolves: rhbz#1852407
* Tue May 19 2020 Attila Lakatos <alakatos@redhat.com> - 0.16-13
- RHEL 8.3
- minor edit of aide.conf to make it consistent
resolves: rhbz#1740754
* Mon Apr 06 2020 Attila Lakatos <alakatos@redhat.com> - 0.16-12
- RHEL 8.3
- minor edit of aide.conf
resolves: rhbz#1740754
- do not generate false warnings when report_ignore_e2fsattrs is specified in aide.conf
resolves: rhbz#1806323
* Wed Jul 24 2019 Radovan Sroka <rsroka@redhat.com> - 0.16-11
- rebuild
- minor edit of aide.conf
* Tue Jul 23 2019 Radovan Sroka <rsroka@redhat.com> - 0.16-10
- respin
- minor edit of aide.conf
* Tue Jul 23 2019 Radovan Sroka <rsroka@redhat.com> - 0.16-9
- Null pointer dereference fix spotted by coverity
resolves: rhbz#1676487
- aide.conf needs updates for RHEL 8
resolves: rhbz#1708015
* Tue Oct 09 2018 Radovan Sroka <rsroka@redhat.com> - 0.16-8 * Tue Oct 09 2018 Radovan Sroka <rsroka@redhat.com> - 0.16-8
- fixed wrong line wrapping of messages in the syslog format - fixed wrong line wrapping of messages in the syslog format
resolves: rhbz#1628153 resolves: rhbz#1628153
...@@ -144,7 +111,7 @@ mkdir -p -m0700 %{buildroot}%{_localstatedir}/lib/aide ...@@ -144,7 +111,7 @@ mkdir -p -m0700 %{buildroot}%{_localstatedir}/lib/aide
* Tue Apr 04 2017 Radovan Sroka <rsroka@redhat.com> - 0.16-1 * Tue Apr 04 2017 Radovan Sroka <rsroka@redhat.com> - 0.16-1
- rebase to stable v0.16 - rebase to stable v0.16
- specfile cleanup - specfile cleanup
- make doc readable - make doc readable
resolves: #1421355 resolves: #1421355
- make aide binary runable for any user - make aide binary runable for any user
resolves: #1421351 resolves: #1421351
...@@ -333,3 +300,4 @@ mkdir -p -m0700 %{buildroot}%{_localstatedir}/lib/aide ...@@ -333,3 +300,4 @@ mkdir -p -m0700 %{buildroot}%{_localstatedir}/lib/aide
* Sun Sep 07 2003 Michael Schwendt <mschwendt[AT]users.sf.net> - 0:0.9-0.fdr.0.1.20030902 * Sun Sep 07 2003 Michael Schwendt <mschwendt[AT]users.sf.net> - 0:0.9-0.fdr.0.1.20030902
- Initial package version. - Initial package version.
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment