diff options
Diffstat (limited to 'app-forensics/ovaldi/files')
6 files changed, 455 insertions, 0 deletions
diff --git a/app-forensics/ovaldi/files/disable-acl.patch b/app-forensics/ovaldi/files/disable-acl.patch new file mode 100644 index 000000000000..49ea42c80558 --- /dev/null +++ b/app-forensics/ovaldi/files/disable-acl.patch @@ -0,0 +1,23 @@ +--- src/probes/unix/FileProbe.cpp.old 2013-01-14 16:28:33.000000000 +0100 ++++ src/probes/unix/FileProbe.cpp 2013-01-14 16:30:33.000000000 +0100 +@@ -427,19 +427,8 @@ + 5) If a file doesn't have an ACL, or it matches the standard UNIX permissions, the value will be 'false' (this is covered by acl_extended_file() - thank you openscap)
+ 6) If a file has an ACL, the value will be 'true'.
+ */
+-
+- int hasExtendedAcl = acl_extended_file(filePath.c_str());
+- if(hasExtendedAcl > -1){ // behavior 4, 5, and 6
+- item->AppendElement(new ItemEntity("has_extended_acl",Common::ToString(hasExtendedAcl),OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_EXISTS,0));
+- }else{
+- if(errno == EOPNOTSUPP){ // behavior 3
+- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_DOES_NOT_EXIST,0));
+- }else{ // behavior 2
+- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_ERROR,0));
+- item->AppendMessage(new OvalMessage(string("Error reading ACL data: ") + strerror(errno)));
+- }
+- }
+
++ item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0));
+ # else
+ // behavior 1
+ item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0));
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.4-disable-selinux-probes.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-disable-selinux-probes.patch new file mode 100644 index 000000000000..b9d02d763c61 --- /dev/null +++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-disable-selinux-probes.patch @@ -0,0 +1,84 @@ +--- src/probes/unix/Process58Probe.cpp.old 2013-01-14 16:05:18.000000000 +0100 ++++ src/probes/unix/Process58Probe.cpp 2013-01-14 16:06:16.000000000 +0100 +@@ -29,8 +29,8 @@ + //****************************************************************************************//
+
+ #ifdef LINUX
+-# include <selinux/selinux.h>
+-# include <selinux/context.h>
++/*# include <selinux/selinux.h>
++# include <selinux/context.h>*/
+ # include <sys/capability.h>
+ # include <SecurityContextGuard.h>
+ #endif
+@@ -328,7 +328,7 @@ + pid_t sessionId;
+ uid_t loginuid;
+ uint64_t effCap, *effCapp=&effCap;
+- string selinuxDomainLabel;
++/* string selinuxDomainLabel;*/
+
+ Process58Probe::ProcStatus statStatus, statusStatus, ttyStatus, loginuidStatus;
+
+@@ -423,10 +423,10 @@ + }
+
+ // this one doesn't require reading anything in /proc
+- if (!RetrieveSelinuxDomainLabel(pid, &selinuxDomainLabel, &errMsg)) {
++/* if (!RetrieveSelinuxDomainLabel(pid, &selinuxDomainLabel, &errMsg)) {
+ item->AppendMessage(new OvalMessage(errMsg, OvalEnum::LEVEL_ERROR));
+ item->SetStatus(OvalEnum::STATUS_ERROR);
+- }
++ }*/
+
+ // The Linux start time is represented as the number of jiffies (1/100 sec)
+ // that the application was started after the last system reboot. To get an
+@@ -522,10 +522,10 @@ + // aren't any.
+ item->AppendElement(new ItemEntity("posix_capability", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_ERROR));
+
+- if (selinuxDomainLabel.empty())
++/* if (selinuxDomainLabel.empty())
+ item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_ERROR));
+ else
+- item->AppendElement(new ItemEntity("selinux_domain_label", selinuxDomainLabel));
++ item->AppendElement(new ItemEntity("selinux_domain_label", selinuxDomainLabel));*/
+
+ if (statStatus == PROC_OK)
+ item->AppendElement(new ItemEntity("session_id", Common::ToString(sessionId), OvalEnum::DATATYPE_INTEGER));
+@@ -740,7 +740,7 @@ + capMap[capEnum]));
+ }
+ }
+-
++/*
+ bool Process58Probe::RetrieveSelinuxDomainLabel(pid_t pid, string *label, string *err) {
+ security_context_t sctx;
+ int ec = getpidcon(pid, &sctx);
+@@ -763,7 +763,7 @@ + *label = tmp;
+ return true;
+ }
+-
++*/
+ #elif defined SUNOS
+
+ void Process58Probe::GetPSInfo(string command, string pidStr, ItemVector* items) {
+@@ -830,7 +830,7 @@ + item->AppendElement(new ItemEntity("exec_shield", "", OvalEnum::DATATYPE_BOOLEAN, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("loginuid", "", OvalEnum::DATATYPE_INTEGER, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("posix_capability", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
+- item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
++/* item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));*/
+ item->AppendElement(new ItemEntity("session_id", Common::ToString(info.pr_sid), OvalEnum::DATATYPE_INTEGER));
+
+ items->push_back(item);
+@@ -988,7 +988,7 @@ + item->AppendElement(new ItemEntity("exec_shield", "", OvalEnum::DATATYPE_BOOLEAN, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("loginuid", "", OvalEnum::DATATYPE_INTEGER, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("posix_capability", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
+- item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
++/* item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));*/
+ item->AppendElement(new ItemEntity("session_id", "", OvalEnum::DATATYPE_INTEGER, OvalEnum::STATUS_NOT_COLLECTED));
+
+ items->push_back(item);
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.4-strnicmp.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-strnicmp.patch new file mode 100644 index 000000000000..fc127efd3cdb --- /dev/null +++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-strnicmp.patch @@ -0,0 +1,11 @@ +--- src/Main.h.old 2010-10-22 14:59:13.000000000 +0200 ++++ src/Main.h 2010-10-22 14:59:38.000000000 +0200 +@@ -38,7 +38,7 @@ + #endif
+
+ #ifdef LINUX
+-# define STRNICMP strnicmp
++# define STRNICMP strncasecmp
+ #elif defined SUNOS
+ # define STRNICMP strncasecmp
+ #elif defined DARWIN
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.4-xerces3.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-xerces3.patch new file mode 100644 index 000000000000..9350029312c4 --- /dev/null +++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-xerces3.patch @@ -0,0 +1,283 @@ +--- src/XmlProcessor.h.old 2011-08-18 14:35:41.608703233 +0200 ++++ src/XmlProcessor.h 2011-08-18 14:39:21.835597094 +0200 +@@ -38,14 +38,17 @@ + #include <string>
+
+ // required xerces includes
+-#include <xercesc/dom/DOMBuilder.hpp>
+ #include <xercesc/dom/DOMDocument.hpp>
+ #include <xercesc/dom/DOMErrorHandler.hpp>
+ #include <xercesc/dom/DOMError.hpp>
+
+ // for entity resolver
+-#include <xercesc/dom/DOMEntityResolver.hpp>
+-#include <xercesc/dom/DOMInputSource.hpp>
++
++#include <xercesc/dom/DOMImplementationRegistry.hpp>
++#include <xercesc/dom/DOMLSParser.hpp>
++#include <xercesc/sax/EntityResolver.hpp>
++#include <xercesc/sax/InputSource.hpp>
++#include <xercesc/sax2/SAX2XMLReader.hpp>
+
+ #include "Exception.h"
+
+@@ -53,12 +56,14 @@ + This class extends the default DOMEntityResolver and implments the resolve entity method
+ to support
+ */
+-class DataDirResolver : public xercesc::DOMEntityResolver {
++class DataDirResolver : public xercesc::EntityResolver {
+ public:
+ /**
+ *
+ */
+- xercesc::DOMInputSource *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI);
++// xercesc::DOMInputSource *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI); ++ xercesc::InputSource *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId); ++ xercesc::DOMLSInput *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI); + };
+
+ /**
+@@ -144,7 +149,7 @@ + * owns the documents it builds. Users must manually destroy
+ * those documents.
+ */
+- xercesc::DOMBuilder *parserWithCallerAdoption;
++ xercesc::DOMLSParser *parserWithCallerAdoption;
+
+ /**
+ * This parser doesn't have user-adoption switched on, so it
+@@ -156,7 +161,7 @@ + * appear to ever be switched off. So to make sure this isn't
+ * leaking memory, I have created separate parsers.
+ */
+- xercesc::DOMBuilder *parser;
++ xercesc::DOMLSParser *parser;
+
+ /** The entity resolver for both parsers. */
+ DataDirResolver resolver;
+--- src/probes/independent/XmlFileContentProbe.cpp.old 2010-10-22 14:49:22.000000000 +0200 ++++ src/probes/independent/XmlFileContentProbe.cpp 2010-10-22 14:51:39.000000000 +0200 +@@ -419,12 +419,24 @@ + return new DummyEntityResolver::DoNothingBinInputStream();
+ }
+
++#if XERCES_VERSION_MAJOR < 3
+ unsigned int DummyEntityResolver::DoNothingBinInputStream::curPos() const
++#else
++const XMLCh* DummyEntityResolver::DoNothingBinInputStream::getContentType() const
++{
++ return NULL;
++}
++XMLFilePos DummyEntityResolver::DoNothingBinInputStream::curPos() const
++#endif
+ {
+ return 0;
+ }
+
++#if XERCES_VERSION_MAJOR < 3
+ unsigned int DummyEntityResolver::DoNothingBinInputStream::readBytes(XMLByte *const /*toFill*/, const unsigned int /*maxToRead*/)
++#else
++XMLSize_t DummyEntityResolver::DoNothingBinInputStream::readBytes(XMLByte *const toFill, XMLSize_t maxToRead)
++#endif
+ {
+ return 0;
+ }
+--- src/probes/independent/XmlFileContentProbe.h.old 2010-10-22 14:55:47.000000000 +0200 ++++ src/probes/independent/XmlFileContentProbe.h 2010-10-22 14:57:00.000000000 +0200 +@@ -134,8 +134,14 @@ + class DoNothingBinInputStream : public BinInputStream
+ {
+ public:
++#if XERCES_VERSION_MAJOR < 3
+ virtual unsigned int curPos() const;
+ virtual unsigned int readBytes(XMLByte *const toFill, const unsigned int maxToRead);
++#else
++ virtual XMLFilePos curPos() const;
++ virtual const XMLCh* getContentType() const;
++ virtual XMLSize_t readBytes(XMLByte *const toFill, XMLSize_t maxToRead);
++#endif
+ };
+ };
+
+--- src/XmlCommon.cpp.old ++++ src/XmlCommon.cpp +@@ -546,7 +546,11 @@ void XmlCommon::AddSchemaLocation(XERCES_CPP_NAMESPACE_QUALIFIER DOMDocument *do + string XmlCommon::GetNamespace(DOMElement *element) {
+
+ string xmlns = "";
++#if XERCES_VERSION_MAJOR < 3
+ xmlns = XmlCommon::ToString(element->getTypeInfo()->getNamespace());
++#else
++ xmlns = XmlCommon::ToString(element->getSchemaTypeInfo()->getTypeNamespace());
++#endif
+ if (xmlns.compare("") == 0) {
+ xmlns = "";
+ }
+--- src/XmlProcessor.cpp.old 2013-01-14 15:16:14.000000000 +0100 ++++ src/XmlProcessor.cpp 2013-01-14 15:19:20.000000000 +0100 +@@ -35,7 +35,6 @@ + // for dom Writer
+ #include <xercesc/dom/DOMImplementation.hpp>
+ #include <xercesc/dom/DOMImplementationLS.hpp>
+-#include <xercesc/dom/DOMWriter.hpp>
+ #include <xercesc/framework/StdOutFormatTarget.hpp>
+ #include <xercesc/framework/LocalFileFormatTarget.hpp>
+ #include <xercesc/util/XMLUni.hpp>
+@@ -50,11 +49,26 @@ + using namespace std;
+ using namespace xercesc;
+
++#if XERCES_VERSION_MAJOR < 3
++#define SetParameter(serializer,n,v) if (serializer->canSetFeature(n,v)) serializer->setFeature(n,v)
++#else
++#define SetParameter(serializer,n,v) if (serializer->getDomConfig()->canSetParameter(n,v)) serializer->getDomConfig()->setParameter(n,v)
++#endif
++
+ //****************************************************************************************//
+ // DataDirResolver Class //
+ //****************************************************************************************//
+-
++#if XERCES_VERSION_MAJOR < 3
+ DOMInputSource* DataDirResolver::resolveEntity (const XMLCh *const /*publicId*/, const XMLCh *const systemId, const XMLCh *const /*baseURI*/) {
++#else
++InputSource* DataDirResolver::resolveEntity(const XMLCh* publicId, const XMLCh* systemId)
++{
++ return NULL;
++ //return DataDirResolver::resolveEntity (publicId, systemId, NULL);
++}
++
++DOMLSInput* DataDirResolver::resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI) {
++#endif
+ string path = "";
+ size_t last;
+ string schemapath = Common::GetSchemaPath();
+@@ -127,7 +141,7 @@ + parserWithCallerAdoption = makeParser(schemaLocation);
+ // add one extra feature on this parser to prevent it from
+ // taking ownership of its documents.
+- parserWithCallerAdoption->setFeature(XMLUni::fgXercesUserAdoptsDOMDocument, true);
++ SetParameter(parserWithCallerAdoption, XMLUni::fgXercesUserAdoptsDOMDocument, true);
+
+ } catch (const XMLException& toCatch) {
+ string errMsg = "Error: An error occured durring initialization of the xml utilities:\n";
+@@ -156,32 +170,40 @@ + XMLPlatformUtils::Terminate();
+ }
+
+-DOMBuilder *XmlProcessor::makeParser(const string &schemaLocation) {
++DOMLSParser *XmlProcessor::makeParser(const string &schemaLocation) {
+ // Instantiate the DOM parser.
+ static const XMLCh gLS[] = { chLatin_L, chLatin_S, chNull };
+ DOMImplementation *impl = DOMImplementationRegistry::getDOMImplementation(gLS);
+
+- DOMBuilder *parser = ((DOMImplementationLS*)impl)->createDOMBuilder(DOMImplementationLS::MODE_SYNCHRONOUS, 0);
++#if XERCES_VERSION_MAJOR < 3
++ DOMLSParser *parser = ((DOMImplementationLS*)impl)->createDOMLSParser(DOMImplementationLS::MODE_SYNCHRONOUS, 0);
++#else
++ DOMLSParser *parser = ((DOMImplementationLS*)impl)->createLSParser(DOMImplementationLS::MODE_SYNCHRONOUS, 0);
++#endif
+
+ ///////////////////////////////////////////////////////
+ // Set features on the builder
+ ///////////////////////////////////////////////////////
+
+- parser->setFeature(XMLUni::fgDOMComments, false); // Discard Comment nodes in the document.
+- parser->setFeature(XMLUni::fgDOMDatatypeNormalization, true); // Let the validation process do its datatype normalization that is defined in the used schema language.
+- parser->setFeature(XMLUni::fgDOMNamespaces, true); // Perform Namespace processing
+- parser->setFeature(XMLUni::fgDOMValidation, true); // Report all validation errors.
+- parser->setFeature(XMLUni::fgXercesSchema, true); // Enable the parser's schema support.
+- parser->setFeature(XMLUni::fgXercesSchemaFullChecking, true); // Enable full schema constraint checking, including checking which may be time-consuming or memory intensive. Currently, particle unique attribution constraint checking and particle derivation restriction checking are controlled by this option.
+- parser->setFeature(XMLUni::fgXercesValidationErrorAsFatal, true); // The parser will treat validation error as fatal and will exit
+- parser->setFeature(XMLUni::fgXercesDOMHasPSVIInfo, true); // Enable storing of PSVI information in element and attribute nodes.
++ SetParameter(parser, XMLUni::fgDOMComments, false); // Discard Comment nodes in the document.
++ SetParameter(parser, XMLUni::fgDOMDatatypeNormalization, true); // Let the validation process do its datatype normalization that is defined in the used schema language.
++ SetParameter(parser, XMLUni::fgDOMNamespaces, true); // Perform Namespace processing
++ SetParameter(parser, XMLUni::fgDOMValidate, true); // Report all validation errors.
++ SetParameter(parser, XMLUni::fgXercesSchema, true); // Enable the parser's schema support.
++ SetParameter(parser, XMLUni::fgXercesSchemaFullChecking, true); // Enable full schema constraint checking, including checking which may be time-consuming or memory intensive. Currently, particle unique attribution constraint checking and particle derivation restriction checking are controlled by this option.
++ SetParameter(parser, XMLUni::fgXercesValidationErrorAsFatal, true); // The parser will treat validation error as fatal and will exit
++ SetParameter(parser, XMLUni::fgXercesDOMHasPSVIInfo, true); // Enable storing of PSVI information in element and attribute nodes.
+
+ ///////////////////////////////////////////////////////
+ //****************************************************************************************//
+ // The following code was added to handle air-gap operation //
+ //****************************************************************************************//
+ /* Look for XML schemas in local directory instead of Internet */
++#if XERCES_VERSION_MAJOR < 3
+ parser->setEntityResolver (&resolver);
++#else
++ parser->getDomConfig()->setParameter(XMLUni::fgXercesEntityResolver, &resolver);
++#endif
+ //****************************************************************************************//
+ // End of air-gap code //
+ //****************************************************************************************//
+@@ -189,7 +211,11 @@ + ///////////////////////////////////////////////////////
+ // Add an Error Handler
+ ///////////////////////////////////////////////////////
++#if XERCES_VERSION_MAJOR < 3
+ parser->setErrorHandler(&errHandler);
++#else
++ parser->getDomConfig()->setParameter(XMLUni::fgDOMErrorHandler, &errHandler);
++#endif
+
+ // Fix a schema location if possible, so instance documents don't
+ // have to set the schemaLocation attribute. And if they do, this
+@@ -197,7 +223,7 @@ + // overriding of the value in instance documents.
+ if (!schemaLocation.empty()) {
+ XMLCh *schemaLocationCstr = XMLString::transcode(schemaLocation.c_str());
+- parser->setProperty(XMLUni::fgXercesSchemaExternalSchemaLocation, schemaLocationCstr);
++ SetParameter(parser, XMLUni::fgXercesSchemaExternalSchemaLocation, schemaLocationCstr);
+ XMLString::release(&schemaLocationCstr);
+ }
+
+@@ -279,23 +305,19 @@ + XMLCh tempStr[100];
+ XMLString::transcode("LS", tempStr, 99);
+ DOMImplementation *impl = DOMImplementationRegistry::getDOMImplementation(tempStr);
++#if XERCES_VERSION_MAJOR < 3
+ DOMWriter *theSerializer = ((DOMImplementationLS*)impl)->createDOMWriter();
++#else
++ DOMLSSerializer *theSerializer = ((DOMImplementationLS*)impl)->createLSSerializer();
++#endif
+
+- // set feature if the serializer supports the feature/mode
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTSplitCdataSections, true))
+- theSerializer->setFeature(XMLUni::fgDOMWRTSplitCdataSections, true);
+
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTDiscardDefaultContent, true))
+- theSerializer->setFeature(XMLUni::fgDOMWRTDiscardDefaultContent, true);
+-
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTFormatPrettyPrint, true))
+- theSerializer->setFeature(XMLUni::fgDOMWRTFormatPrettyPrint, true);
+-
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTBOM, false))
+- theSerializer->setFeature(XMLUni::fgDOMWRTBOM, false);
+-
+- //if (theSerializer->canSetFeature(XMLUni::fgDOMWRTDiscardDefaultContent, true))
+- // theSerializer->setFeature(XMLUni::fgDOMWRTBOM, true);
++ // set feature if the serializer supports the feature/mode
++ SetParameter(theSerializer, XMLUni::fgDOMWRTSplitCdataSections, true);
++ SetParameter(theSerializer, XMLUni::fgDOMWRTDiscardDefaultContent, true);
++ SetParameter(theSerializer, XMLUni::fgDOMWRTFormatPrettyPrint, true);
++ SetParameter(theSerializer, XMLUni::fgDOMWRTBOM, false);
++ //SetParameter(theSerializer, XMLUni::fgDOMWRTBOM, true);
+
+ //
+ // Plug in a format target to receive the resultant
+@@ -313,7 +335,13 @@ + //
+ // do the serialization through DOMWriter::writeNode();
+ //
++#if XERCES_VERSION_MAJOR < 3
+ theSerializer->writeNode(myFormTarget, *doc);
++#else
++ DOMLSOutput *output = ((DOMImplementationLS*)impl)->createLSOutput();
++ output->setByteStream(myFormTarget);
++ theSerializer->write(doc, output);
++#endif
+
+ theSerializer->release();
+ delete myFormTarget;
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable-acl.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable-acl.patch new file mode 100644 index 000000000000..6d6fbf60178e --- /dev/null +++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable-acl.patch @@ -0,0 +1,23 @@ +--- src/probes/unix/FileProbe.cpp.old 2014-10-08 09:15:37.000000000 +0200 ++++ src/probes/unix/FileProbe.cpp 2014-10-08 09:15:55.000000000 +0200 +@@ -386,18 +386,8 @@ + 6) If a file has an ACL, the value will be 'true'. + */ + +- int hasExtendedAcl = acl_extended_file(filePath.c_str()); +- if(hasExtendedAcl > -1){ // behavior 4, 5, and 6 +- item->AppendElement(new ItemEntity("has_extended_acl",Common::ToString(hasExtendedAcl),OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_EXISTS,0)); +- }else{ +- if(errno == EOPNOTSUPP){ // behavior 3 +- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_DOES_NOT_EXIST,0)); +- }else{ // behavior 2 +- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_ERROR,0)); +- item->AppendMessage(new OvalMessage(string("Error reading ACL data: ") + strerror(errno))); +- } +- } +- ++ // behavior 1 ++ item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0)); + # else + // behavior 1 + item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0)); diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch new file mode 100644 index 000000000000..11d369022b03 --- /dev/null +++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch @@ -0,0 +1,31 @@ +--- src/probes/unix/Process58Probe.cpp.old 2014-10-08 08:56:37.000000000 +0200 ++++ src/probes/unix/Process58Probe.cpp 2014-10-08 08:57:58.000000000 +0200 +@@ -743,26 +743,8 @@ + } + + bool Process58Probe::RetrieveSelinuxDomainLabel(pid_t pid, string *label, string *err) { +- security_context_t sctx; +- int ec = getpidcon(pid, &sctx); +- if (ec == -1) { +- // getpidcon man page doesn't say errno is set... so we can't get a +- // reason for the error. +- *err = "getpidcon() failed"; +- return false; +- } +- +- SecurityContextGuard scg(sctx); +- ContextGuard cg(sctx); +- +- const char *tmp = context_type_get(cg); +- if (!tmp) { +- *err = string("context_get_type(")+sctx+"): "+strerror(errno); +- return false; +- } +- +- *label = tmp; +- return true; ++ *err = string("context_get_type(NotImplmented)"); ++ return false; + } + + #elif defined SUNOS |