diff --git a/audit-4.0.5-af_unix.patch b/audit-4.0.5-af_unix.patch new file mode 100644 index 0000000..b790b33 --- /dev/null +++ b/audit-4.0.5-af_unix.patch @@ -0,0 +1,43 @@ +From 3ea61d367cf4456be3513adcdbb84714eb89d1ed Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Thu, 5 Jun 2025 22:07:31 -0400 +Subject: [PATCH] af_unix plugin: Restore terminating newlines + +--- + audisp/plugins/af_unix/audisp-af_unix.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/audisp/plugins/af_unix/audisp-af_unix.c b/audisp/plugins/af_unix/audisp-af_unix.c +index 3df6b61c9..ecaf30650 100644 +--- a/audisp/plugins/af_unix/audisp-af_unix.c ++++ b/audisp/plugins/af_unix/audisp-af_unix.c +@@ -207,17 +207,17 @@ static int event_to_string(struct audit_dispatcher_header *hdr, + "UNKNOWN[%u]", hdr->type); + type = unknown; + } +- len = asprintf(&v, "type=%s msg=%.*s", ++ len = asprintf(&v, "type=%s msg=%.*s\n", + type, hdr->size, data); + } else if (inbound_protocol == F_BINARY && + hdr->ver == AUDISP_PROTOCOL_VER2) { + // Protocol 2 events are already formatted +- len = asprintf(&v, "%.*s", hdr->size, data); ++ len = asprintf(&v, "%.*s\n", hdr->size, data); + } else + len = 0; + } else if (inbound_protocol == F_STRING) { + // Inbound strings start at the hdr +- len = asprintf(&v, "%s", (char *)hdr); ++ len = asprintf(&v, "%s\n", (char *)hdr); + } else + len = 0; + if (len <= 0) { +@@ -226,7 +226,7 @@ static int event_to_string(struct audit_dispatcher_header *hdr, + return -1; + } + +- /* Strip newlines from event record */ ++ /* Strip newlines from event record except the last one */ + ptr = v; + while ((ptr = strchr(ptr, 0x0A)) != NULL) { + if (ptr != &v[len-1]) diff --git a/audit.spec b/audit.spec index b40a9bd..f10a34a 100644 --- a/audit.spec +++ b/audit.spec @@ -2,11 +2,12 @@ Summary: User space tools for kernel auditing Name: audit Version: 4.0.5 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: https://github.com/linux-audit/audit-userspace/ Source0: audit-userspace-%{version}.tar.gz Source1: https://www.gnu.org/licenses/lgpl-2.1.txt +Patch1: audit-4.0.5-af_unix.patch BuildRequires: make gcc BuildRequires: autoconf automake libtool BuildRequires: kernel-headers >= 5.0 @@ -97,6 +98,7 @@ The audit rules package contains the rules and utilities to load audit rules. %prep %setup -q -n %{name}-userspace-%{version} +%patch -P 1 -p1 cp %{SOURCE1} . %build @@ -132,7 +134,7 @@ touch -r ./audit.spec $RPM_BUILD_ROOT/etc/libaudit.conf touch -r ./audit.spec $RPM_BUILD_ROOT/usr/share/man/man5/libaudit.conf.5.gz %check -#make check +make check # Get rid of make files so that they don't get packaged. rm -f rules/Makefile* @@ -297,6 +299,9 @@ fi %attr(750,root,root) %{_sbindir}/audispd-zos-remote %changelog +* Thu Jun 26 2025 Steve Grubb 4.0.5-2 +- Apply audit-4.0.5-af_unix.patch (#2375024) + * Wed Jun 11 2025 Steve Grubb 4.0.5-1 - New upstream release