summaryrefslogtreecommitdiff
path: root/app-forensics/aide/files
diff options
context:
space:
mode:
authorV3n3RiX <venerix@koprulu.sector>2022-05-12 16:42:50 +0300
committerV3n3RiX <venerix@koprulu.sector>2022-05-12 16:42:50 +0300
commit752d6256e5204b958b0ef7905675a940b5e9172f (patch)
tree330d16e6362a49cbed8875a777fe641a43376cd3 /app-forensics/aide/files
parent0c100b7dd2b30e75b799d806df4ef899fd98e1ea (diff)
gentoo resync : 12.05.2022
Diffstat (limited to 'app-forensics/aide/files')
-rw-r--r--app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch23
-rw-r--r--app-forensics/aide/files/aide-0.16.2_p20200614_define_hash_use_gcrypt.patch37
-rw-r--r--app-forensics/aide/files/aide.conf-r1133
-rw-r--r--app-forensics/aide/files/aide.cron192
4 files changed, 0 insertions, 385 deletions
diff --git a/app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch b/app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch
deleted file mode 100644
index 453abe5f1eae..000000000000
--- a/app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-commit 6da37687ba7cf259ac19cae2e1c16115b6848143
-Author: Ilya Tumaykin <itumaykin@gmail.com>
-Date: Thu May 25 13:34:55 2017 +0300
-
-build: fix incorrect LIBS/LDFLAGS mixing
-
-Otherwise build with LDFLAGS='-Wl,--as-needed' and curl support fails.
-See https://bugs.gentoo.org/show_bug.cgi?id=271326
-and https://sourceforge.net/p/aide/bugs/96/
-
-diff --git a/configure.ac b/configure.ac
-index 3598ebe..0c5cb0c 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -713,7 +713,7 @@ if test x$with_curl = xyes; then
- AC_CHECK_HEADERS(curl/curl.h,,
- [AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])])
- CFLAGS="$CFLAGS $CURL_CFLAGS"
-- LDFLAGS="$LDFLAGS $CURL_LIBS"
-+ LIBS="$LIBS $CURL_LIBS"
- AC_CHECK_LIB(curl,curl_easy_init,havecurl=yes,
- [AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])]
- )
diff --git a/app-forensics/aide/files/aide-0.16.2_p20200614_define_hash_use_gcrypt.patch b/app-forensics/aide/files/aide-0.16.2_p20200614_define_hash_use_gcrypt.patch
deleted file mode 100644
index e643a0017de8..000000000000
--- a/app-forensics/aide/files/aide-0.16.2_p20200614_define_hash_use_gcrypt.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-diff -Nur aide-0.16/include/md.h aide-0.16.new/include/md.h
---- aide-0.16/include/md.h 2016-07-25 22:56:55.000000000 +0200
-+++ aide-0.16.new/include/md.h 2018-11-21 14:07:01.347479021 +0100
-@@ -48,7 +48,7 @@
- #define HASH_GCRYPT_COUNT GCRY_MD_CRC32
- #ifndef WITH_MHASH
- #define HASH_USE_GCRYPT (DB_MD5|DB_SHA1|DB_RMD160|DB_TIGER|DB_CRC32|\
-- DB_HAVAL|DB_CRC32|DB_SHA256|DB_SHA512)
-+ DB_CRC32B|DB_SHA256|DB_SHA512)
- #endif
- #endif
-
-diff -Nur aide-0.16/src/md.c aide-0.16.new/src/md.c
---- aide-0.16/src/md.c 2016-07-25 22:56:55.000000000 +0200
-+++ aide-0.16.new/src/md.c 2018-11-21 14:06:05.602295496 +0100
-@@ -55,10 +55,12 @@
- r=DB_TIGER;
- break;
- }
-+/* until libgcrypt-1.8.4 not implemented yet, see doc/gcrypt.info-1
- case GCRY_MD_HAVAL: {
- r=DB_HAVAL;
- break;
- }
-+*/
- case GCRY_MD_SHA256: {
- r=DB_SHA256;
- break;
-@@ -219,7 +221,7 @@
- if(gcry_md_enable(md->mdh,i)==GPG_ERR_NO_ERROR){
- md->calc_attr|=h;
- } else {
-- error(0,"gcry_md_enable %i failed",i);
-+ error(0,"gcry_md_enable %i failed, see /usr/include/gcrypt.h enum gcry_md_algos",i);
- md->todo_attr&=~h;
- }
- }
diff --git a/app-forensics/aide/files/aide.conf-r1 b/app-forensics/aide/files/aide.conf-r1
deleted file mode 100644
index 87df5e168c80..000000000000
--- a/app-forensics/aide/files/aide.conf-r1
+++ /dev/null
@@ -1,133 +0,0 @@
-# Example configuration file for AIDE
-# See more: man 5 aide.conf
-
-database=file:/var/lib/aide/aide.db
-database_out=file:/var/lib/aide/aide.db.new
-
-# Change this to "no" or remove it to not gzip output
-# (only useful on systems with few CPU cycles to spare)
-gzip_dbout=yes
-
-# Default: 5
-#verbose=5
-
-report_url=file:/var/log/aide/aide.log
-report_url=stdout
-#report_url=stderr
-
-# Here are all the things we can check - these are the default rules
-#
-# p: permissions
-# ftype: file type
-# i: inode
-# l: link name
-# n: number of links
-# u: user
-# g: group
-# s: size
-# b: block count
-# m: mtime (modification time)
-# a: atime (access time)
-# c: ctime (change time)
-# S: check for growing size
-# I: ignore changed filename
-# ANF: allow new files
-# ARF: allow removed files
-# md5: md5 checksum
-# sha1: sha1 checksum
-# sha256: sha256 checksum
-# sha512: sha512 checksum
-# rmd160: rmd160 checksum
-# tiger: tiger checksum
-# crc32: crc32 checksum
-# R: p+ftype+i+l+n+u+g+s+m+c+md5+X
-# L: p+ftype+i+l+n+u+g+X
-# E: Empty group
-# X: acl+selinux+xattrs+e2fsattrs (if groups are explicitly enabled)
-# >: Growing file p+ftype+l+u+g+i+n+S+X
-
-# Defines formerly set here have been moved to /etc/default/aide.
-
-# Custom rules
-Binlib = p+i+n+u+g+s+b+m+c+md5+sha256+rmd160
-ConfFiles = p+i+n+u+g+s+b+m+c+md5+sha256+rmd160
-Logs = p+i+n+u+g+S
-Devices = p+i+n+u+g+s+b+c+md5+sha256+rmd160
-Databases = p+n+u+g
-StaticDir = p+i+n+u+g
-ManPages = p+i+n+u+g+s+b+m+c+md5+sha256+rmd160
-
-# Next decide what directories/files you want in the database
-
-# Kernel, system map, etc.
-=/boot$ Binlib
-# Configs
-/etc ConfFiles
-!/etc/mtab
-# Binaries
-/bin Binlib
-/sbin Binlib
-/usr/bin Binlib
-/usr/sbin Binlib
-/usr/libexec Binlib
-/usr/local/bin Binlib
-/usr/local/sbin Binlib
-#/usr/games Binlib
-# Libraries
-/lib(64)? Binlib
-/usr/lib(64)? Binlib
-/usr/local/lib(64)? Binlib
-# Log files
-=/var/log$ StaticDir
-#!/var/log/ksymoops
-/var/log/aide/aide.log(.[0-9])?(.gz)? Databases
-/var/log/aide/error.log(.[0-9])?(.gz)? Databases
-#/var/log/setuid.changes(.[0-9])?(.gz)? Databases
-!/var/log/aide
-/var/log Logs
-# Devices
-!/dev/pts
-# If you get spurious warnings about being unable to mmap() /dev/cpu/mtrr,
-# you may uncomment this to get rid of them. They're harmless but sometimes
-# annoying.
-#!/dev/cpu/mtrr
-#!/dev/xconsole
-/dev Devices
-# Other miscellaneous files
-/var/run$ StaticDir
-!/var/run
-# Test only the directory when dealing with /proc
-/proc$ StaticDir
-!/proc
-
-# You can look through these examples to get further ideas
-
-# MD5 sum files - especially useful with debsums -g
-#/var/lib/dpkg/info/([^\.]+).md5sums u+g+s+m+md5+sha1
-
-# Check crontabs
-#/var/spool/anacron/cron.daily Databases
-#/var/spool/anacron/cron.monthly Databases
-#/var/spool/anacron/cron.weekly Databases
-#/var/spool/cron Databases
-#/var/spool/cron/crontabs Databases
-
-# manpages can be trojaned, especially depending on *roff implementation
-#/usr/man ManPages
-#/usr/share/man ManPages
-#/usr/local/man ManPages
-
-# docs
-#/usr/doc ManPages
-#/usr/share/doc ManPages
-
-# check users' home directories
-#/home Binlib
-
-# check sources for modifications
-#/usr/src L
-#/usr/local/src L
-
-# Check headers for same
-#/usr/include L
-#/usr/local/include L
diff --git a/app-forensics/aide/files/aide.cron b/app-forensics/aide/files/aide.cron
deleted file mode 100644
index c28b78f8e9db..000000000000
--- a/app-forensics/aide/files/aide.cron
+++ /dev/null
@@ -1,192 +0,0 @@
-#!/bin/bash
-# Modified: Benjamin Smee
-# Date: Fri Sep 10 11:35:41 BST 2004
-
-# This is the email address reports get mailed to
-MAILTO=root@localhost
-
-# Set this to suppress mailings when there's nothing to report
-QUIETREPORTS=1
-
-# This parameter defines which aide command to run from the cron script.
-# Sensible values are "update" and "check".
-# Default is "check", ensuring backwards compatibility.
-# Since "update" does not take any longer, it is recommended to use "update",
-# so that a new database is created every day. The new database needs to be
-# manually copied over the current one, though.
-COMMAND=update
-
-# This parameter defines how many lines to return per e-mail. Output longer
-# than this value will be truncated in the e-mail sent out.
-LINES=1000
-
-# This parameter gives a grep regular expression. If given, all output lines
-# that _don't_ match the regexp are listed first in the script's output. This
-# allows to easily remove noise from the aide report.
-NOISE="(/var/cache/|/var/lib/|/var/tmp)"
-PATH="/bin:/usr/bin:/sbin:/usr/sbin"
-LOGDIR="/var/log/aide"
-LOGFILE="aide.log"
-CONFFILE="/etc/aide/aide.conf"
-ERRORLOG="aide_error.log"
-MAILLOG="aide_mail.log"
-ERRORTMP=`tempfile --directory "/tmp" --prefix "$ERRORLOG"`
-
-[ -f /usr/bin/aide ] || exit 0
-
-DATABASE=`grep "^database=file:/" $CONFFILE | head -n 1 | cut --delimiter=: --fields=2`
-FQDN=`hostname -f`
-DATE=`date +"at %Y-%m-%d %H:%M"`
-
-# default values
-
-DATABASE="${DATABASE:-/var/lib/aide/aide.db}"
-
-AIDEARGS="-V4"
-
-if [ ! -f $DATABASE ]; then
- /usr/sbin/sendmail $MAILTO <<EOF
-Subject: Daily AIDE report for $FQDN
-From: root@${FQDN}
-To: ${MAILTO}
-Fatal error: The AIDE database does not exist!
-This may mean you haven't created it, or it may mean that someone has removed it.
-EOF
- exit 0
-fi
-
-# Removed so no deps on debianutils - strerror
-#[ -f "$LOGDIR/$LOGFILE" ] && savelog -j -t -g adm -m 640 -u root -c 7 "$LOGDIR/$LOGFILE" > /dev/null
-#[ -f "$LOGDIR/$ERRORLOG" ] && savelog -j -t -g adm -m 640 -u root -c 7 "$LOGDIR/$ERRORLOG" > /dev/null
-
-aide $AIDEARGS --$COMMAND >"$LOGDIR/$LOGFILE" 2>"$ERRORTMP"
-RETVAL=$?
-
-if [ -n "$QUIETREPORTS" ] && [ $QUIETREPORTS -a \! -s $LOGDIR/$LOGFILE -a \! -s $ERRORTMP ]; then
- # Bail now because there was no output and QUIETREPORTS is set
- exit 0
-fi
-
-MAILTMP=`tempfile --directory "/tmp" --prefix "$MAILLOG"`
-
-(cat << EOF
-This is an automated report generated by the Advanced Intrusion Detection
-Environment on $FQDN ${DATE}.
-
-EOF
-
-# include error log in daily report e-mail
-
-if [ "$RETVAL" != "0" ]; then
- cat > "$LOGDIR/$ERRORLOG" << EOF
-
-*****************************************************************************
-* aide returned a non-zero exit value *
-*****************************************************************************
-
-EOF
- echo "exit value is: $RETVAL" >> "$LOGDIR/$ERRORLOG"
-else
- touch "$LOGDIR/$ERRORLOG"
-fi
-< "$ERRORTMP" cat >> "$LOGDIR/$ERRORLOG"
-rm -f "$ERRORTMP"
-
-if [ -s "$LOGDIR/$ERRORLOG" ]; then
- errorlines=`wc -l "$LOGDIR/$ERRORLOG" | awk '{ print $1 }'`
- if [ ${errorlines:=0} -gt $LINES ]; then
- cat << EOF
-
-****************************************************************************
-* aide has returned many errors. *
-* the error log output has been truncated in this mail *
-****************************************************************************
-
-EOF
- echo "Error output is $errorlines lines, truncated to $LINES."
- head -$LINES "$LOGDIR/$ERRORLOG"
- echo "The full output can be found in $LOGDIR/$ERRORLOG."
- else
- echo "Errors produced ($errorlines lines):"
- cat "$LOGDIR/$ERRORLOG"
- fi
-else
- echo "AIDE produced no errors."
-fi
-
-# include de-noised log
-
-if [ -n "$NOISE" ]; then
- NOISETMP=`tempfile --directory "/tmp" --prefix "aidenoise"`
- NOISETMP2=`tempfile --directory "/tmp" --prefix "aidenoise"`
- sed -n '1,/^Detailed information about changes:/p' "$LOGDIR/$LOGFILE" | \
- grep '^\(changed\|removed\|added\):' | \
- grep -v "^added: THERE WERE ALSO [0-9]\+ FILES ADDED UNDER THIS DIRECTORY" > $NOISETMP2
-
- if [ -n "$NOISE" ]; then
- < $NOISETMP2 grep -v "^\(changed\|removed\|added\):$NOISE" > $NOISETMP
- rm -f $NOISETMP2
- echo "De-Noised output removes everything matching $NOISE."
- else
- mv $NOISETMP2 $NOISETMP
- echo "No noise expression was given."
- fi
-
- if [ -s "$NOISETMP" ]; then
- loglines=`< $NOISETMP wc -l | awk '{ print $1 }'`
- if [ ${loglines:=0} -gt $LINES ]; then
- cat << EOF
-
-****************************************************************************
-* aide has returned long output which has been truncated in this mail *
-****************************************************************************
-
-EOF
- echo "De-Noised output is $loglines lines, truncated to $LINES."
- < $NOISETMP head -$LINES
- echo "The full output can be found in $LOGDIR/$LOGFILE."
- else
- echo "De-Noised output of the daily AIDE run ($loglines lines):"
- cat $NOISETMP
- fi
- else
- echo "AIDE detected no changes after removing noise."
- fi
- rm -f $NOISETMP
- echo "============================================================================"
-fi
-
-# include non-de-noised log
-
-if [ -s "$LOGDIR/$LOGFILE" ]; then
- loglines=`wc -l "$LOGDIR/$LOGFILE" | awk '{ print $1 }'`
- if [ ${loglines:=0} -gt $LINES ]; then
- cat << EOF
-
-****************************************************************************
-* aide has returned long output which has been truncated in this mail *
-****************************************************************************
-
-EOF
- echo "Output is $loglines lines, truncated to $LINES."
- head -$LINES "$LOGDIR/$LOGFILE"
- echo "The full output can be found in $LOGDIR/$LOGFILE."
- else
- echo "Output of the daily AIDE run ($loglines lines):"
- cat "$LOGDIR/$LOGFILE"
- fi
-else
- echo "AIDE detected no changes."
-fi
-) > ${MAILTMP}
-
-(
-cat <<EOF
-Subject: Daily AIDE report for $FQDN
-From: root@${FQDN}
-To: ${MAILTO}
-EOF
-cat ${MAILTMP}
-) | /usr/sbin/sendmail $MAILTO
-
-rm -f "$MAILTMP"