From 4fbd49b95970e832571fcc3359cb94491725106f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 8 Jun 2025 20:39:52 +0000 Subject: [PATCH 1/7] audit: 4.0.3 -> 4.0.5 (cherry picked from commit 4379d92dc957b3bf12971e907184c744b38afe4d) --- pkgs/by-name/au/audit/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index 0ad9ac9f055a..820d39137744 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -17,13 +17,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "audit"; - version = "4.0.3"; + version = "4.0.5"; src = fetchFromGitHub { owner = "linux-audit"; repo = "audit-userspace"; tag = "v${finalAttrs.version}"; - hash = "sha256-+M5Nai/ruK16udsHcMwv1YoVQbCLKNuz/4FCXaLbiCw="; + hash = "sha256-SgMt1MmcH7r7O6bmJCetRg3IdoZXAXjVJyeu0HRfyf8="; }; postPatch = '' From 21f5a2c283334d7205a77073e4ec222c4f3b57a5 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 25 Jun 2025 15:41:06 +0200 Subject: [PATCH 2/7] audit: support loading audisp plugins from symlinks Upstream PR: https://github.com/linux-audit/audit-userspace/pull/467 (cherry picked from commit 39e88985f738716bbf6b8cb89763ae4917783dcf) --- pkgs/by-name/au/audit/package.nix | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index 820d39137744..cc87889f03b9 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch, autoreconfHook, bash, buildPackages, @@ -26,6 +27,24 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-SgMt1MmcH7r7O6bmJCetRg3IdoZXAXjVJyeu0HRfyf8="; }; + patches = [ + # nix configures most stuff by symlinks, e.g. in /etc + # thus, for plugins to be picked up, symlinks must be allowed + # https://github.com/linux-audit/audit-userspace/pull/467 + (fetchpatch { + url = "https://github.com/linux-audit/audit-userspace/pull/467/commits/dbefc642b3bd0cafe599fcd18c6c88cb672397ee.patch?full_index=1"; + hash = "sha256-Ksn/qKBQYFAjvs1OVuWhgWCdf4Bdp9/a+MrhyJAT+Bw="; + }) + (fetchpatch { + url = "https://github.com/linux-audit/audit-userspace/pull/467/commits/50094f56fefc0b9033ef65e8c4f108ed52ef5de5.patch?full_index=1"; + hash = "sha256-CJKDLdlpsCd+bG6j5agcnxY1+vMCImHwHGN6BXURa4c="; + }) + (fetchpatch { + url = "https://github.com/linux-audit/audit-userspace/pull/467/commits/5e75091abd297807b71b3cfe54345c2ef223939a.patch?full_index=1"; + hash = "sha256-LPpO4PH/3MyCJq2xhmhhcnFeK3yh7LK6Mjypuvhacu4="; + }) + ]; + postPatch = '' substituteInPlace bindings/swig/src/auditswig.i \ --replace-fail "/usr/include/linux/audit.h" \ From 9a6b9afa89c779798002365489ad1ee9d06b94e0 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 25 Jun 2025 15:41:57 +0200 Subject: [PATCH 3/7] audit: add grimmauld to maintainers (cherry picked from commit 59f60cc6ad82aa47d0cb71ffd486edfb588ffef8) --- pkgs/by-name/au/audit/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index cc87889f03b9..d8abee529f78 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: { description = "Audit Library"; changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v${finalAttrs.version}"; license = lib.licenses.gpl2Plus; - maintainers = with lib.maintainers; [ ]; + maintainers = with lib.maintainers; [ grimmauld ]; platforms = lib.platforms.linux; }; }) From df0d14e7162399fc01ee2ebc53c0c94011cb5275 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 25 Jun 2025 22:42:40 +0200 Subject: [PATCH 4/7] audit: add updateScript (cherry picked from commit 1838aeba8b5034daa95fc2fa14c2e87d0c2fd264) --- pkgs/by-name/au/audit/package.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index d8abee529f78..e633133fff1f 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -15,6 +15,7 @@ # configure script tries executing python to gather info instead of relying on # python3-config exclusively enablePython ? stdenv.hostPlatform == stdenv.buildPlatform, + nix-update-script, }: stdenv.mkDerivation (finalAttrs: { pname = "audit"; @@ -89,8 +90,11 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; - passthru.tests = { - musl = pkgsCross.musl64.audit; + passthru = { + updateScript = nix-update-script { }; + tests = { + musl = pkgsCross.musl64.audit; + }; }; meta = { From 9a26d5313b00747aa8f84fea79d75cc277970f2c Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 25 Jun 2025 23:01:30 +0200 Subject: [PATCH 5/7] audit: add pkg-config meta and tester (cherry picked from commit 916454f79645ecba4da6b7974927fea9cc4a8d60) --- pkgs/by-name/au/audit/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index e633133fff1f..ba908eddbd8f 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -16,6 +16,7 @@ # python3-config exclusively enablePython ? stdenv.hostPlatform == stdenv.buildPlatform, nix-update-script, + testers, }: stdenv.mkDerivation (finalAttrs: { pname = "audit"; @@ -94,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: { updateScript = nix-update-script { }; tests = { musl = pkgsCross.musl64.audit; + pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; }; }; @@ -103,6 +105,10 @@ stdenv.mkDerivation (finalAttrs: { changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v${finalAttrs.version}"; license = lib.licenses.gpl2Plus; maintainers = with lib.maintainers; [ grimmauld ]; + pkgConfigModules = [ + "audit" + "auparse" + ]; platforms = lib.platforms.linux; }; }) From 51b8c408a6ebaedfebadf2b3eaee88856c362f4f Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 25 Jun 2025 23:12:13 +0200 Subject: [PATCH 6/7] audit: build with libcap_ng See auditd-plugins(5) for motivation: > When the audit daemon starts your plugin, you will be running as root. > If you do not need root privileges, you should change uid/gid to lower > chances of being a target for exploit. If you need to retain capabilities, > using libcap-ng is the simplest way. `libcap_ng` is already in the closure via util-linux and thus does not unnecessarily bloat the system. It is also a very sane idea to allow plugins to drop privileges if they already conveniently support it. (cherry picked from commit 4db1e1cf1356bf7569db932fb339efa83657ee5d) --- pkgs/by-name/au/audit/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index ba908eddbd8f..62732842d66a 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -10,6 +10,7 @@ python3, swig, pkgsCross, + libcap_ng, # Enabling python support while cross compiling would be possible, but the # configure script tries executing python to gather info instead of relying on @@ -78,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ bash + libcap_ng ]; configureFlags = [ @@ -86,6 +88,9 @@ stdenv.mkDerivation (finalAttrs: { "--disable-zos-remote" "--with-arm" "--with-aarch64" + # capability dropping, currently mostly for plugins as those get spawned as root + # see auditd-plugins(5) + "--with-libcap-ng=yes" (if enablePython then "--with-python" else "--without-python") ]; From 0b55cdb96d2b57258e37fc682e4b350626c4dfa2 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Thu, 10 Jul 2025 14:44:58 +0200 Subject: [PATCH 7/7] audit: 4.0.5 -> 4.1.0 Changelog: https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.0 (cherry picked from commit 8e3888242d2d88094893251c5bdd36b2bfc828f8) --- pkgs/by-name/au/audit/musl.patch | 76 +++++++++++++++++++++++++++++++ pkgs/by-name/au/audit/package.nix | 26 ++++------- 2 files changed, 84 insertions(+), 18 deletions(-) create mode 100644 pkgs/by-name/au/audit/musl.patch diff --git a/pkgs/by-name/au/audit/musl.patch b/pkgs/by-name/au/audit/musl.patch new file mode 100644 index 000000000000..8485a0759548 --- /dev/null +++ b/pkgs/by-name/au/audit/musl.patch @@ -0,0 +1,76 @@ +From 87c782153deb10bd8c3345723a8bcee343826e78 Mon Sep 17 00:00:00 2001 +From: Grimmauld +Date: Thu, 10 Jul 2025 18:58:31 +0200 +Subject: [PATCH 1/2] lib/audit_logging.h: fix includes for musl + +`sys/types.h` is indirectly included with `glibc`, +but needs to be specified explicitly on musl. +--- + lib/audit_logging.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/audit_logging.h b/lib/audit_logging.h +index 9082a2720..c58861b1e 100644 +--- a/lib/audit_logging.h ++++ b/lib/audit_logging.h +@@ -25,6 +25,7 @@ + + // Next include is to pick up the function attribute macros + #include ++#include + #include + + #ifdef __cplusplus + +From 98adfcc4bfa66ac25db0b609d7172d7d40c4f85f Mon Sep 17 00:00:00 2001 +From: Grimmauld +Date: Fri, 11 Jul 2025 08:11:21 +0200 +Subject: [PATCH 2/2] Guard __attr_dealloc_free seperately from __attr_dealloc + +Otherwise, header include order matters when building against a libc that +does not itself define __attr_dealloc_free, such as musl. +--- + auparse/auparse.h | 2 ++ + lib/audit_logging.h | 2 ++ + lib/libaudit.h | 2 ++ + 3 files changed, 6 insertions(+) + +diff --git a/auparse/auparse.h b/auparse/auparse.h +index 48375e2c7..ba5139625 100644 +--- a/auparse/auparse.h ++++ b/auparse/auparse.h +@@ -31,6 +31,8 @@ + #endif + #ifndef __attr_dealloc + # define __attr_dealloc(dealloc, argno) ++#endif ++#ifndef __attr_dealloc_free + # define __attr_dealloc_free + #endif + #ifndef __attribute_malloc__ +diff --git a/lib/audit_logging.h b/lib/audit_logging.h +index c58861b1e..fab7e75d1 100644 +--- a/lib/audit_logging.h ++++ b/lib/audit_logging.h +@@ -40,6 +40,8 @@ extern "C" { + #endif + #ifndef __attr_dealloc + # define __attr_dealloc(dealloc, argno) ++#endif ++#ifndef __attr_dealloc_free + # define __attr_dealloc_free + #endif + // Warn unused result +diff --git a/lib/libaudit.h b/lib/libaudit.h +index 2c51853b7..cce5dc493 100644 +--- a/lib/libaudit.h ++++ b/lib/libaudit.h +@@ -43,6 +43,8 @@ + // malloc and free assignments + #ifndef __attr_dealloc + # define __attr_dealloc(dealloc, argno) ++#endif ++#ifndef __attr_dealloc_free + # define __attr_dealloc_free + #endif + #ifndef __attribute_malloc__ diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index 62732842d66a..0f8f600251da 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchFromGitHub, - fetchpatch, autoreconfHook, bash, buildPackages, @@ -21,31 +20,18 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "audit"; - version = "4.0.5"; + version = "4.1.0"; src = fetchFromGitHub { owner = "linux-audit"; repo = "audit-userspace"; tag = "v${finalAttrs.version}"; - hash = "sha256-SgMt1MmcH7r7O6bmJCetRg3IdoZXAXjVJyeu0HRfyf8="; + hash = "sha256-MWlHaGue7Ca8ks34KNg74n4Rfj8ivqAhLOJHeyE2Q04="; }; patches = [ - # nix configures most stuff by symlinks, e.g. in /etc - # thus, for plugins to be picked up, symlinks must be allowed - # https://github.com/linux-audit/audit-userspace/pull/467 - (fetchpatch { - url = "https://github.com/linux-audit/audit-userspace/pull/467/commits/dbefc642b3bd0cafe599fcd18c6c88cb672397ee.patch?full_index=1"; - hash = "sha256-Ksn/qKBQYFAjvs1OVuWhgWCdf4Bdp9/a+MrhyJAT+Bw="; - }) - (fetchpatch { - url = "https://github.com/linux-audit/audit-userspace/pull/467/commits/50094f56fefc0b9033ef65e8c4f108ed52ef5de5.patch?full_index=1"; - hash = "sha256-CJKDLdlpsCd+bG6j5agcnxY1+vMCImHwHGN6BXURa4c="; - }) - (fetchpatch { - url = "https://github.com/linux-audit/audit-userspace/pull/467/commits/5e75091abd297807b71b3cfe54345c2ef223939a.patch?full_index=1"; - hash = "sha256-LPpO4PH/3MyCJq2xhmhhcnFeK3yh7LK6Mjypuvhacu4="; - }) + # https://github.com/linux-audit/audit-userspace/pull/476 + ./musl.patch ]; postPatch = '' @@ -54,6 +40,10 @@ stdenv.mkDerivation (finalAttrs: { "${linuxHeaders}/include/linux/audit.h" ''; + # https://github.com/linux-audit/audit-userspace/issues/474 + # building databuf_test fails otherwise, as that uses hidden symbols only available in the static builds + dontDisableStatic = true; + outputs = [ "bin" "lib"