2:06 a.m.
Hello,
With 2.3.5, libauparse is exporting a new symbol (clear_config())
It seems that all the other symbols are prefixed with either auparse_
or audit_, so is this expected?
Cheers,
Laurent Bigonville
Output of some debian tools:
--- debian/libauparse0.symbols (libauparse0_1:2.3.5-1_amd64)
+++ dpkg-gensymbols5cm36h 2014-04-08 17:59:09.324337637 +0000
@@ -43,3 +43,4 @@
ausearch_clear@Base 1:2.2.1
ausearch_next_event@Base 1:2.2.1
ausearch_set_stop@Base 1:2.2.1
+ clear_config@Base 1:2.3.5-1
6:25 a.m.
On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
With 2.3.5, libauparse is exporting a new symbol (clear_config())
It seems that all the other symbols are prefixed with either auparse_
or audit_, so is this expected?
No, this was not expected. It should be an internal use only function. Is this
causing any symbol collision in a known program?
Thanks,
-Steve
1:54 a.m.
Le Thu, 10 Apr 2014 07:25:42 -0400,
Steve Grubb <sgrubb(a)redhat.com> a écrit :
On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> With 2.3.5, libauparse is exporting a new symbol (clear_config())
>
> It seems that all the other symbols are prefixed with either
> auparse_ or audit_, so is this expected?
No, this was not expected. It should be an internal use only
function. Is this causing any symbol collision in a known program?
Searching[0] quickly in the code that is present in the debian archive,
I see that at least lxc has the same function name, but I didn't
encounter collision myself.
Apparently libaudit also has some symbols that are not prefixed
by audit_[1], but these seems a bit less generic than "clear_config()"
Cheers,
Laurent Bigonville
[0] http://codesearch.debian.net/
[1]
http://anonscm.debian.org/gitweb/?p=collab-maint/audit.git;a=blob;f=debia...
8:42 a.m.
On Friday, April 11, 2014 08:54:37 AM Laurent Bigonville wrote:
Le Thu, 10 Apr 2014 07:25:42 -0400,
Steve Grubb <sgrubb(a)redhat.com> a écrit :
> On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> > With 2.3.5, libauparse is exporting a new symbol (clear_config())
> >
> > It seems that all the other symbols are prefixed with either
> > auparse_ or audit_, so is this expected?
>
> No, this was not expected. It should be an internal use only
> function. Is this causing any symbol collision in a known program?
Searching[0] quickly in the code that is present in the debian archive,
I see that at least lxc has the same function name, but I didn't
encounter collision myself.
Thanks for checking this. I don't think lxr would be using auparse, so I think
we are safe. That said, the fix is to add the following:
void clear_config(struct daemon_conf *config) hidden;
to auparse/internal.h and then recompile. It's already in svn and will be in
the next release, which should be in the next week or so.
Apparently libaudit also has some symbols that are not prefixed
by audit_[1], but these seems a bit less generic than "clear_config()"
Thanks. I don't see anything here likely to cause a collision.
-Steve
[0] http://codesearch.debian.net/
[1]
http://anonscm.debian.org/gitweb/?p=collab-maint/audit.git;a=blob;f=debian/l
ibaudit1.symbols;h=1d1af3e008ab7858b3e6996563a9a9a5b4aa7723;hb=HEAD
7:46 a.m.
Le Fri, 11 Apr 2014 09:42:50 -0400,
Steve Grubb <sgrubb(a)redhat.com> a écrit :
On Friday, April 11, 2014 08:54:37 AM Laurent Bigonville wrote:
> Le Thu, 10 Apr 2014 07:25:42 -0400,
>
> Steve Grubb <sgrubb(a)redhat.com> a écrit :
> > On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> > > With 2.3.5, libauparse is exporting a new symbol
> > > (clear_config())
> > >
> > > It seems that all the other symbols are prefixed with either
> > > auparse_ or audit_, so is this expected?
> >
> > No, this was not expected. It should be an internal use only
> > function. Is this causing any symbol collision in a known program?
>
> Searching[0] quickly in the code that is present in the debian
> archive, I see that at least lxc has the same function name, but I
> didn't encounter collision myself.
Thanks for checking this. I don't think lxr would be using auparse,
so I think we are safe. That said, the fix is to add the following:
void clear_config(struct daemon_conf *config) hidden;
to auparse/internal.h and then recompile. It's already in svn and
will be in the next release, which should be in the next week or so.
Thanks!
Something else somehow related, I just received a bugreport about the
load_config() function being declared in both auditd core and the
prelude plugin https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744282
Cheers,
Laurent Bigonville
7:06 a.m.
On Saturday, April 12, 2014 02:46:38 PM Laurent Bigonville wrote:
Le Fri, 11 Apr 2014 09:42:50 -0400,
Steve Grubb <sgrubb(a)redhat.com> a écrit :
> On Friday, April 11, 2014 08:54:37 AM Laurent Bigonville wrote:
> > Le Thu, 10 Apr 2014 07:25:42 -0400,
> >
> > Steve Grubb <sgrubb(a)redhat.com> a écrit :
> > > On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> > > > With 2.3.5, libauparse is exporting a new symbol
> > > > (clear_config())
> > > >
> > > > It seems that all the other symbols are prefixed with either
> > > > auparse_ or audit_, so is this expected?
> > >
> > > No, this was not expected. It should be an internal use only
> > > function. Is this causing any symbol collision in a known program?
> >
> > Searching[0] quickly in the code that is present in the debian
> > archive, I see that at least lxc has the same function name, but I
> > didn't encounter collision myself.
>
> Thanks for checking this. I don't think lxr would be using auparse,
> so I think we are safe. That said, the fix is to add the following:
>
> void clear_config(struct daemon_conf *config) hidden;
>
> to auparse/internal.h and then recompile. It's already in svn and
> will be in the next release, which should be in the next week or so.
Thanks!
Something else somehow related, I just received a bugreport about the
load_config() function being declared in both auditd core and the
prelude plugin https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744282
Something seems wrong with that report. the prelude plugin and auditd are two
entirely different programs. But looking deeper, I wonder if what they meant
was that the prelude plugin links with auparse which uses the visibility
settings to hide a load_config function from the ABI?
-Steve
3905
days inactive
3909
days old
linux-audit@lists.linux-audit.osci.io
5 comments
2 participants
participants (2)
-
Laurent Bigonville -
Steve Grubb