9:49 a.m.
Hi all,
I got the "audit-1.1.4.tar.gz" from http://people.redhat.com/sgrubb/audit/,
but I got some errors during the make step on my Debian system as below:
In file included from /usr/include/linux/sched.h:12,
from /usr/include/linux/audit.h:27,
from libaudit.h:35,
from libaudit.c:42:
/usr/include/linux/jiffies.h:84: error: syntax error before 'jiffies_64'
/usr/include/linux/jiffies.h:88: error: syntax error before 'get_jiffies_64'
/usr/include/linux/jiffies.h: In function 'timespec_to_jiffies':
/usr/include/linux/jiffies.h:320: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:320: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:320: error: 'NSEC_PER_SEC' undeclared (first
use in this function)
/usr/include/linux/jiffies.h:320: error: (Each undeclared identifier is
reported only once
/usr/include/linux/jiffies.h:320: error: for each function it appears in.)
/usr/include/linux/jiffies.h:321: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:321: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:324: error: syntax error before 'sec'
/usr/include/linux/jiffies.h:324: error: syntax error before 'NSEC_PER_SEC'
/usr/include/linux/jiffies.h:324: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:324: error: syntax error before ')' token
/usr/include/linux/jiffies.h: In function 'jiffies_to_timespec':
/usr/include/linux/jiffies.h:337: error: syntax error before 'nsec'
/usr/include/linux/jiffies.h:338: error: 'nsec' undeclared (first use in
this function)
/usr/include/linux/jiffies.h:338: error: 'NSEC_PER_SEC' undeclared (first
use in this function)
/usr/include/linux/jiffies.h: In function 'timeval_to_jiffies':
/usr/include/linux/jiffies.h:359: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:359: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:359: error: 'NSEC_PER_SEC' undeclared (first
use in this function)
/usr/include/linux/jiffies.h:360: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:360: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:363: error: syntax error before 'sec'
/usr/include/linux/jiffies.h:363: error: syntax error before 'NSEC_PER_SEC'
/usr/include/linux/jiffies.h:363: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:363: error: syntax error before ')' token
/usr/include/linux/jiffies.h: In function 'jiffies_to_timeval':
/usr/include/linux/jiffies.h:375: error: syntax error before 'nsec'
/usr/include/linux/jiffies.h:376: error: 'nsec' undeclared (first use in
this function)
/usr/include/linux/jiffies.h:376: error: 'NSEC_PER_SEC' undeclared (first
use in this function)
/usr/include/linux/jiffies.h:377: error: 'NSEC_PER_USEC' undeclared (first
use in this function)
Does anyone know how can I solve it?
BR,
Mauricio Lin.
10:04 a.m.
On Tuesday 21 February 2006 10:49, Mauricio Lin wrote:
In file included from /usr/include/linux/sched.h:12,
from /usr/include/linux/audit.h:27,
from libaudit.h:35,
/usr/include/linux/jiffies.h:84: error: syntax error before 'jiffies_64'
/usr/include/linux/jiffies.h:88: error: syntax error before 'get_jiffies_64'
Sounds like a problem in the kernel headers. Probably a missing include.
-Steve
10:09 a.m.
On 2/21/06, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Tuesday 21 February 2006 10:49, Mauricio Lin wrote:
> In file included from /usr/include/linux/sched.h:12,
> from /usr/include/linux/audit.h:27,
> from libaudit.h:35,
>/usr/include/linux/jiffies.h:84: error: syntax error before 'jiffies_64'
>/usr/include/linux/jiffies.h:88: error: syntax error before
'get_jiffies_64'
Sounds like a problem in the kernel headers. Probably a missing include.
Do you mean the jiffies.h or sched.h or audit.h is missing an include?
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
10:35 a.m.
On Tuesday 21 February 2006 11:09, Mauricio Lin wrote:
> > In file included from /usr/include/linux/sched.h:12,
> > from /usr/include/linux/audit.h:27,
> > from libaudit.h:35,
> >/usr/include/linux/jiffies.h:84: error: syntax error before
'jiffies_64'
> >/usr/include/linux/jiffies.h:88: error: syntax error before
>
> 'get_jiffies_64'
>
> Sounds like a problem in the kernel headers. Probably a missing include.
Do you mean the jiffies.h or sched.h or audit.h is missing an include?
jiffies.h is where all the errors are, so its the one that is probably missing
the include. I have no idea what include it needs, but it seems to be
something that defines a common type.
-Steve
12:44 p.m.
All,
I've been on this list for quite some time trying to keep track of an
'inherent' (kernel based) auditing capability to meet NISPOM requirements.
It seems you guys are there (and have been) for a while.
I understand that the distribution used is Redhat, and given this Debian
topic, I'd like to ask what the major changes would be to make this
available in Debian. A kernel patch, some header changes, and the client
(user-space) tools? Am I missing anything big?
Thanks,
Mike
-----Original Message-----
From: linux-audit-bounces(a)redhat.com [mailto:linux-audit-bounces@redhat.com]
On Behalf Of Steve Grubb
Sent: Tuesday, February 21, 2006 11:36 AM
To: Mauricio Lin
Cc: linux-audit(a)redhat.com
Subject: Re: Linux audit for Debian
On Tuesday 21 February 2006 11:09, Mauricio Lin wrote:
> > In file included from /usr/include/linux/sched.h:12, from
> >/usr/include/linux/audit.h:27, from libaudit.h:35,
> >/usr/include/linux/jiffies.h:84: error: syntax error before
'jiffies_64'
> >/usr/include/linux/jiffies.h:88: error: syntax error before
>
> 'get_jiffies_64'
>
> Sounds like a problem in the kernel headers. Probably a missing include.
Do you mean the jiffies.h or sched.h or audit.h is missing an include?
jiffies.h is where all the errors are, so its the one that is probably
missing the include. I have no idea what include it needs, but it seems to
be something that defines a common type.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
1 p.m.
On Tuesday 21 February 2006 13:44, Michael Fecina wrote:
I understand that the distribution used is Redhat, and given this
Debian
topic, I'd like to ask what the major changes would be to make this
available in Debian. A kernel patch,
You will likely need the file system auditing patch which is still being
developed. The RHEL4 kernel has a patch that lets it meet NISPOM but needed
rework to get upstream acceptance.
some header changes,
Not really, libaudit.h takes care of a lot of it.
and the client (user-space) tools?
Yes, you need to do some patching here and configuring. NISPOM seems mostly
concerned with login/logout, file access, blacklisting of accounts/terminals,
and audit reports.
The login/logout...we patched sshd, login, and gdm to provide the right audit
events. These are also pamified and have the pam_loginuid module added to
their config. Pam itself is modified to provide audit records. I think we've
submitted that upstream, but not 100% sure. If not, we intended it to go
upstream for everyone to use.
Blacklisting is done with pam_tally. It has been updated to provide anomaly
records when it blacklists an account.
As for audit reports, aureport was designed to meet this. It can be scripted
and put into a cron job.
There have been ABI changes in libaudit. If you use FC4 as a model...you want
the audit-1.0.14 package. If you use FC5 as a model, you want audit-1.1.4.
You cannot mix and match audit packages and trusted app patches.
-Steve
1:05 p.m.
On Tue, 21 Feb 2006 13:44:02 EST, Michael Fecina said:
I understand that the distribution used is Redhat, and given this
Debian
topic, I'd like to ask what the major changes would be to make this
available in Debian. A kernel patch, some header changes, and the client
(user-space) tools? Am I missing anything big?
Has anybody checked recently on building a kernel with audit but without SELinux?
3:22 p.m.
Hi all,
I have checked the first error that points to line 84 of jiffies.h that is:
extern u64 __jiffy_data jiffies_64; /* line 84 */
the header file of u64 is included through <linux/types.h> and the
__jiffy_data is defined in the jiffies.h as:
#define __jiffy_data __attribute__((section(".data")))
/* INITIAL OUTPUT OF MAKE STEP */
In file included from /usr/include/linux/sched.h:12,
from /usr/include/linux/audit.h:27,
from libaudit.h:35,
from libaudit.c:42:
/usr/include/linux/jiffies.h:84: error: syntax error before 'jiffies_64'
/usr/include/linux/jiffies.h:88: error: syntax error before 'get_jiffies_64'
/usr/include/linux/jiffies.h: In function 'timespec_to_jiffies':
/usr/include/linux/jiffies.h:320: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:320: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:320: error: 'NSEC_PER_SEC' undeclared (first
use in this function)
/usr/include/linux/jiffies.h:320: error: (Each undeclared identifier is
reported only once
/usr/include/linux/jiffies.h:320: error: for each function it appears in.)
/usr/include/linux/jiffies.h:321: error: called object 'u64' is not a
function
/usr/include/linux/jiffies.h:321: error: called object 'u64' is not a
function
Does anyone have another suggestion?
BR,
Mauricio Lin.
On 2/21/06, Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> wrote:
On Tue, 21 Feb 2006 13:44:02 EST, Michael Fecina said:
> I understand that the distribution used is Redhat, and given this Debian
> topic, I'd like to ask what the major changes would be to make this
> available in Debian. A kernel patch, some header changes, and the
client
> (user-space) tools? Am I missing anything big?
Has anybody checked recently on building a kernel with audit but without
SELinux?
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
4:19 p.m.
Hi Grubb,
BTW, Is there any restriction about the version of kernel headers?
I have changed to headers of kernel 2.6.15.3, but errors keeps happening.
What is the version of kernel headers do you recommend?
BR,
Mauricio Lin.
On 2/21/06, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Tuesday 21 February 2006 11:09, Mauricio Lin wrote:
> > > In file included from /usr/include/linux/sched.h:12,
> > > from /usr/include/linux/audit.h:27,
> > > from libaudit.h:35,
> > >/usr/include/linux/jiffies.h:84: error: syntax error before
'jiffies_64'
> > >/usr/include/linux/jiffies.h:88: error: syntax error before
> >
> > 'get_jiffies_64'
> >
> > Sounds like a problem in the kernel headers. Probably a missing
include.
>
> Do you mean the jiffies.h or sched.h or audit.h is missing an include?
jiffies.h is where all the errors are, so its the one that is probably
missing
the include. I have no idea what include it needs, but it seems to be
something that defines a common type.
-Steve
4:26 p.m.
On Tuesday 21 February 2006 17:19, Mauricio Lin wrote:
BTW, Is there any restriction about the version of kernel headers?
Usually the kernel headers that user space uses are "sanitized" kernel headers
and not the kernel's copy. For us, they are in the glibc-kernheaders package.
I do not know how Debian does it...maybe someone else can help you.
-Steve
10:41 a.m.
Hi all,
I managed to build the syscall auditing tool on my Debian system.
Basically I downloded the glibc-kernheaders-3.0-5.2.i386.rpm from
ftp://rpmfind.net/linux/fedora/core/development/i386/Fedora/RPMS/glibc-ke...
I converted it to tgz format as:
# alien -t glibc-kernheaders-3.0-5.2.i386.rpm
Afterwards the glibc-kernheaders-3.0.tgz is generated in your current
directory.
You can extract it in your current directory as:
# tar xzvf glibc-kernheaders-3.0.tgz
the extracted files are located in ./usr/include/ (under you current
directory). There are 3 directories under ./usr/include, so copy them
manually to /usr/local/include/ (system directory).
Assuming you are under the directory you extracted the tgz file, do
something like:
cp -r usr/include/* /usr/local/include (Do not confuse with your system
/usr/include)
Now the 'make' can be done normally.
BR,
Mauricio Lin.
On 2/21/06, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Tuesday 21 February 2006 17:19, Mauricio Lin wrote:
> BTW, Is there any restriction about the version of kernel headers?
Usually the kernel headers that user space uses are "sanitized" kernel
headers
and not the kernel's copy. For us, they are in the glibc-kernheaders
package.
I do not know how Debian does it...maybe someone else can help you.
-Steve
6877
days inactive
6878
days old
linux-audit@lists.linux-audit.osci.io
10 comments
4 participants
participants (4)
-
Mauricio Lin -
Michael Fecina -
Steve Grubb -
Valdis.Kletnieks＠vt.edu