[Aide-devel] [PATCH] Reworked package building V2
Brought to you by:
hvhaugwitz,
rvdb
From: Steve G. <sg...@re...> - 2010-02-11 21:11:57
|
Hello, There were a couple problems in aide that seems to have popped up as autoconf/make have evolved. On Fedora 12, any rebuild that included autoreconf would fail to locate libz. Also, make distcheck was not working. The patch below fixes these problems and modernizes configure and the makefiles. This patch also obsoletes conf_lex2.c and db_lex2.c. After applying this patch, they may be deleted from cvs. This patch also adds include/Makefile.am which will need to be added to cvs. This patch adds support for PIE executables and makes relocations read only when the static build is disabled. It also tests the compiler to see if some of the new warnings are available and if so adds them to the CFLAGS. Please test this on other distributions. I have checked this on Fedora 12 and RHEL4 to make sure it works on new and somewhat older systems. I believe this patch preserves the static build, but I was not able to test that extensively. Please report any issues to this mail list and I will try to address them with a reworked patch. Thanks, -Steve diff -urN aide.orig/autogen.sh aide/autogen.sh --- aide.orig/autogen.sh 2010-02-09 15:53:04.000000000 -0500 +++ aide/autogen.sh 2010-02-11 15:53:19.000000000 -0500 @@ -1,83 +1,4 @@ #!/bin/sh # Run this to generate all the initial makefiles, etc. -# -# Needs bash, Solaris sh will not work - -PGM=AIDE - -#libtool_vers=1.3 - -DIE=no -autoconf_vers=2.50 -automake_vers=1.10 -aclocal_vers=1.10 - -autoconf_guess=("autoconf" "autoconf2.50") -automake_guess=("automake") -aclocal_guess=("aclocal") - -set -e - -function check_version() { - if $1 --version | awk 'NR==1 { if( $NF >= '$2' ) exit 0; exit 1; }' ; then - return 0; - fi - return 1; -} - -function check_exists() { - if $1 --version < /dev/null > /dev/null 2>&1 ; then - return 0; - fi - return 1; -} - -function print_error() { - echo "**Error**: "\`$1\'" is too old or not installed" - echo ' (version ' $2 ' or newer is required)' - DIE="yes" -} - -function my_try() { - if check_exists $1 && \ - check_version $1 $2 ; then - return 0; - fi - return 1; -} - -function check() { - eval vers=\$${1}_vers - printf "checking "$1" for "$vers - eval vals=\${${1}_guess[*]} - for a in $vals - do - if my_try $a $vers ; then - echo " ok" - eval ${1}_bin=$a; - return 0 - fi - done - echo " No" - print_error $a $vers - return 1 -} - -check autoconf -check automake -check aclocal - -if test "$DIE" = "yes"; then - exit 1 -fi - -echo "Running aclocal..." -$aclocal_bin -echo "Running autoheader..." -autoheader -echo "Running automake --gnu ..." -$automake_bin --gnu; -echo "Running autoconf..." -$autoconf_bin - +autoreconf -fv --install echo "You can now run \"./configure\" and then \"make\"." diff -urN aide.orig/configure.in aide/configure.in --- aide.orig/configure.in 2010-02-09 15:53:04.000000000 -0500 +++ aide/configure.in 2010-02-11 15:57:33.000000000 -0500 @@ -2,7 +2,8 @@ dnl Initialize autoconf/automake AC_INIT(aide, AIDE_VERSION) -AC_CONFIG_SRCDIR(src/aide.c) +AC_CONFIG_MACRO_DIR([m4]) +AC_CANONICAL_TARGET AM_INIT_AUTOMAKE AC_DEFINE_UNQUOTED(AIDEVERSION, "AIDE_VERSION") @@ -15,6 +16,7 @@ AC_PROG_CC AC_PROG_MAKE_SET AC_PROG_RANLIB +AC_PROG_INSTALL AC_PROG_YACC if test "x${YACC}" != "xbison -y"; then echo "AIDE requires GNU bison" @@ -26,11 +28,11 @@ echo "AIDE requires GNU flex" exit 5 fi +dnl We only ask for libtool so that $LD is set later +AM_PROG_LIBTOOL AC_PATH_PROG(PKG_CONFIG, pkg-config, "") -AM_MAINTAINER_MODE - dnl AC_ARG_PROGRAM AC_ARG_WITH(extra-includes, @@ -50,7 +52,7 @@ ) dnl Do the right thing for glibc... -AC_DEFINE(_GNU_SOURCE,1,[unhide _GLIBC symbols]) +AIDE_DEFS="-D_GNU_SOURCE" dnl This is borrowed from libtool @@ -162,14 +164,82 @@ # Check whether static linking has explicitly been disabled AC_ARG_ENABLE(static,[ --disable-static Disable static linking (lowers the security of aide)], [aide_static_choice=$enableval], [aide_static_choice=yes]) -if test "$aide_static_choice" != "yes"; then - LD_STATIC_FLAG="" -fi +dnl Borrowed from dbus +cc_supports_flag() { + AC_MSG_CHECKING(whether $CC supports "$@") + Cfile=/tmp/foo${$} + touch ${Cfile}.c + $CC -c "$@" ${Cfile}.c -o ${Cfile}.o >/dev/null 2>&1 + rc=$? + rm -f ${Cfile}.c ${Cfile}.o + case $rc in + 0) AC_MSG_RESULT(yes);; + *) AC_MSG_RESULT(no);; + esac + return $rc +} -CFLAGS="$CFLAGS $LD_STATIC_FLAG" -CPPFLAGS="$CPPFLAGS $LD_STATIC_FLAG" +dnl Borrowed from dbus +ld_supports_flag() { + AC_MSG_CHECKING([whether $LD supports "$@"]) + AC_TRY_LINK([ + int one(void) { return 1; } + int two(void) { return 2; } + ], [ two(); ] , [_ac_ld_flag_supported=yes], [_ac_ld_flag_supported=no]) + + if test "$_ac_ld_flag_supported" = "yes"; then + rm -f conftest.c + touch conftest.c + if $CC -c conftest.c; then + ld_out=`$LD $@ -o conftest conftest.o 2>&1` + ld_ret=$? + if test $ld_ret -ne 0 ; then + _ac_ld_flag_supported=no + elif echo "$ld_out" | egrep 'option ignored|^usage:|unrecognized option|illegal option' >/dev/null ; then + _ac_ld_flag_supported=no + fi + fi + rm -f conftest.c conftest.o conftest + fi + + AC_MSG_RESULT($_ac_ld_flag_supported) + if test "$_ac_ld_flag_supported" = "yes" ; then + return 0 + else + return 1 + fi +} -AC_SUBST(LD_STATIC_FLAG) +if test "$aide_static_choice" != "yes"; then + LD_STATIC_FLAG="" + EXTRA_LDFLAGS="" + EXTRA_CFLAGS="" + if test x$CC = "xgcc"; then + if ld_supports_flag -z,relro; then + EXTRA_LDFLAGS="$EXTRA_LDFLAGS -z relro" + fi + if ld_supports_flag -z now; then + EXTRA_LDFLAGS="$EXTRA_LDFLAGS -z now" + fi + if cc_supports_flag -fPIE -DPIE; then + EXTRA_CFLAGS="$EXTRA_CFLAGS -fPIE -DPIE" + EXTRA_LDFLAGS="$EXTRA_LDFLAGS -pie" + fi + dnl Check for some optional warnings + if cc_supports_flag -Wundef; then + EXTRA_CFLAGS="$EXTRA_CFLAGS -Wundef" + fi + if cc_supports_flag -Wmissing-format-attribute; then + EXTRA_CFLAGS="$EXTRA_CFLAGS -Wmissing-format-attribute" + fi + if cc_supports_flag -Wshadow; then + EXTRA_CFLAGS="$EXTRA_CFLAGS -Wshadow" + fi + if cc_supports_flag -Wlogical-op; then + EXTRA_CFLAGS="$EXTRA_CFLAGS -Wlogical-op" + fi + fi +fi dnl This macro is new in autoconf-2.13 AC_SEARCH_LIBS(syslog, bsd socket inet, [AC_DEFINE(HAVE_SYSLOG,1,[syslog available?])]) @@ -461,9 +531,7 @@ # This looks weird because Linux defines lstat64 and then screws it up AC_CHECK_FUNC(lstat64, [AC_CHECK_FUNC(stat64, - AC_DEFINE(_LARGEFILE_SOURCE,1,[Functions for correct standard I/O]) - AC_DEFINE(_LARGEFILE64_SOURCE,1,[Additional functionality from LFS]) - AC_DEFINE(_FILE_OFFSET_BITS,64,[Select 64 bits filesystem interface]) + AIDE_DEFS+=" -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS" AIDE_LSTAT_FUNC="lstat64" compoptionstring="${compoptionstring}WITH_LSTAT64\\n" AIDE_STAT_FUNC="stat64" @@ -573,15 +641,15 @@ AC_DEFINE_UNQUOTED(DEFAULT_DB,"$default_db",[Default location of signature database]) AC_DEFINE_UNQUOTED(DEFAULT_DB_OUT,"$default_db_out",[Default output location for newly-generated signature database]) +dnl Do the library tests with the static flag +LDFLAGS="$LDFLAGS $LD_STATIC_FLAG" if test x$with_zlib = xyes; then - AC_CHECK_HEADERS(zlib.h,, + AC_CHECK_HEADERS(zlib.h,[], [AC_MSG_ERROR([You don't have zlib properly installed. Install it or try --without-zlib.])]) save_LDFLAGS=$LDFLAGS - LDFLAGS="$LDFLAGS $LD_STATIC_FLAG" - AC_CHECK_LIB(z,gzdopen,, + AC_CHECK_LIB(z, deflate,[], [AC_MSG_ERROR([You don't have zlib properly installed. Install it or try --without-zlib.])] ) - LDFLAGS=$save_LDFLAGS AC_DEFINE(WITH_ZLIB,1,[use zlib]) fi @@ -595,13 +663,11 @@ fi AC_CHECK_HEADERS(curl/curl.h,, [AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])]) -# save_LDFLAGS=$LDFLAGS - CFLAGS="$CFLAGS $CURL_CFLAGS" - LDFLAGS="$LDFLAGS $CURL_LIBS $LD_STATIC_FLAG" + CFLAGS="$CFLAGS $CURL_CFLAGS" + LDFLAGS="$LDFLAGS $CURL_LIBS" AC_CHECK_LIB(curl,curl_easy_init,havecurl=yes, [AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])] ) -# LDFLAGS=$save_LDFLAGS AC_DEFINE(WITH_CURL,1,[use curl]) compoptionstring="${compoptionstring}WITH_CURL\\n"], fi @@ -617,7 +683,7 @@ [AC_DEFINE(REGEX, 1, [use bundled GNU regex]) compoptionstring="${compoptionstring}WITH_GNU_REGEXP\\n"], [test "x$with_gnu_regexp" = xcheck], - [AC_CHECK_FUNCS(regexec regcomp,, + [AC_CHECK_FUNCS(regexec regcomp,[], [AC_DEFINE(REGEX,1,[use bundled GNU regex]) compoptionstring="${compoptionstring}WITH_GNU_REGEXP\\n"] )], @@ -667,7 +733,7 @@ AC_CHECK_LIB([gpg-error], [gpg_strerror], [saveLIBS="$LIBS" LIBS="$LIBS -lgpg-error" - AC_CHECK_LIB([gcrypt], [gcry_md_hash_buffer],, + AC_CHECK_LIB([gcrypt], [gcry_md_hash_buffer],[], AC_MSG_ERROR([Aide requires mhash or libcrypt to be installed with static libraries.]) ) LIBS="$saveLIBS"], @@ -844,9 +910,9 @@ [with_psql=no] ) -AS_IF([test "x$with_psql" != xno ], +AS_IF([test "x$with_psql" != xno], AC_DEFINE(WITH_PSQL,1,[postgresql support]) - AC_CHECK_LIB(pq,PQclear,, + AC_CHECK_LIB(pq,PQclear,[], with_psql=no AC_MSG_RESULT([not found]) ) @@ -889,7 +955,10 @@ AC_DEFINE_UNQUOTED(AIDECOMPILEOPTIONS, "${compoptionstring}",[Compile-time options displayed in -v output]) +dnl Add in the optional compiler features +LDFLAGS="$LDFLAGS $EXTRA_LDFLAGS" +CFLAGS="$CFLAGS $EXTRA_CFLAGS" -AC_CONFIG_FILES(Makefile src/Makefile doc/Makefile doc/aide.conf doc/aide.1 doc/aide.conf.5 aide.spec) -AC_OUTPUT +AC_SUBST(AIDE_DEFS) +AC_OUTPUT(Makefile src/Makefile include/Makefile doc/Makefile doc/aide.conf doc/aide.1 doc/aide.conf.5 aide.spec) diff -urN aide.orig/doc/Makefile.am aide/doc/Makefile.am --- aide.orig/doc/Makefile.am 2010-02-09 15:53:04.000000000 -0500 +++ aide/doc/Makefile.am 2010-02-11 15:53:19.000000000 -0500 @@ -21,4 +21,4 @@ man_MANS = aide.1 aide.conf.5 -EXTRA_DIST = aide.1 aide.conf.5 manual.html +EXTRA_DIST = $(man_MANS) manual.html diff -urN aide.orig/include/aide.h aide/include/aide.h --- aide.orig/include/aide.h 2010-02-09 15:53:04.000000000 -0500 +++ aide/include/aide.h 2010-02-11 15:53:19.000000000 -0500 @@ -21,7 +21,7 @@ #define _AIDE_H_INCLUDED #include "config.h" -#include "report.h" +#include "types.h" #include "db_config.h" #include <stdlib.h> #include <unistd.h> @@ -31,6 +31,7 @@ #if HAVE_FCNTL_H # include <fcntl.h> #endif +#include "report.h" #ifndef TEMP_FAILURE_RETRY /* Evaluate EXPRESSION, and repeat as long as it returns -1 with errno' diff -urN aide.orig/include/db_config.h aide/include/db_config.h --- aide.orig/include/db_config.h 2010-02-09 15:53:04.000000000 -0500 +++ aide/include/db_config.h 2010-02-11 15:53:19.000000000 -0500 @@ -21,12 +21,12 @@ #ifndef _DB_CONFIG_H_INCLUDED #define _DB_CONFIG_H_INCLUDED #include "aide.h" +#include "types.h" #include <unistd.h> #include <stdio.h> #define E2O(n) (1<<n) -#include "types.h" #include "list.h" #include "seltree.h" diff -urN aide.orig/include/db_list.h aide/include/db_list.h --- aide.orig/include/db_list.h 2010-02-09 15:53:04.000000000 -0500 +++ aide/include/db_list.h 2010-02-11 15:53:19.000000000 -0500 @@ -20,13 +20,15 @@ #ifndef _DB_LIST_H_INCLUDED #define _DB_LIST_H_INCLUDED + +#include <stdio.h> /* for NULL */ + typedef struct db_list{ - dbline* data - db_list* next - db_list* prev - db_list* head - db_list* tail -} db_list + struct db_list* next; + struct db_list* prev; + struct db_list* head; + struct db_list* tail; +} db_list; /* Only the head knows for sure where the tail is */ static db_list* db_list_head=NULL; diff -urN aide.orig/include/Makefile.am aide/include/Makefile.am --- aide.orig/include/Makefile.am 1969-12-31 19:00:00.000000000 -0500 +++ aide/include/Makefile.am 2010-02-11 15:53:19.000000000 -0500 @@ -0,0 +1,24 @@ +# +# aide, Advanced Intrusion Detection Environment +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2, or (at your option) +# any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; see the file COPYING. If not, write to +# the Free Software Foundation, 59 Temple Place - Suite 330, +# Boston, MA 02111-1307, USA. +# + +noinst_HEADERS = aide.h base64.h be.h commandconf.h compare_db.h \ + conf_lex.h db_config.h db_disk.h db_file.h db.h db_list.h \ + db_sql.h do_md.h fopen.h gen_list.h getopt.h gnu_regex.h \ + list.h locale-aide.h md.h report.h seltree.h snprintf.h \ + symboltable.h types.h url.h util.h diff -urN aide.orig/include/report.h aide/include/report.h --- aide.orig/include/report.h 2010-02-09 15:53:04.000000000 -0500 +++ aide/include/report.h 2010-02-11 15:53:19.000000000 -0500 @@ -24,6 +24,7 @@ #include <stdio.h> #include <stdarg.h> #include "db_config.h" +#include "url.h" /* Exitcodes */ #define ERROR_WRITING_ERROR 14 diff -urN aide.orig/include/types.h aide/include/types.h --- aide.orig/include/types.h 2010-02-09 15:53:04.000000000 -0500 +++ aide/include/types.h 2010-02-11 15:53:19.000000000 -0500 @@ -21,7 +21,6 @@ #ifndef _TYPES_H_INCLUDED #define _TYPES_H_INCLUDED -#include "aide.h" /* The AC_CHECK_SIZEOF() in configure fails for some machines. * we provide some fallback values here */ @@ -38,10 +37,8 @@ # define SIZEOF_UNSIGNED_LONG 4 #endif - #include <sys/types.h> - #ifndef HAVE_BYTE # undef byte /* maybe there is a macro with this name */ typedef unsigned char byte; diff -urN aide.orig/Makefile.am aide/Makefile.am --- aide.orig/Makefile.am 2010-02-09 15:53:04.000000000 -0500 +++ aide/Makefile.am 2010-02-11 15:53:19.000000000 -0500 @@ -17,7 +17,7 @@ # Boston, MA 02111-1307, USA. # -SUBDIRS = src doc +SUBDIRS = include src doc datadir = @datadir@ localedir = $(datadir)/locale @@ -25,22 +25,8 @@ CLEANFILES = *~ -DIST_SOURCES = src/conf_lex.l src/db_lex.l -DIST_SUBDIRS = $(SUBDIRS) -EXTRA_DIST = version.m4 Todo LICENSE-snprintf.txt README-snprintf - -check: update-db - src/aide -c doc/aide.conf -V20 - -update-db: all - src/aide -B "database_out=file://@abs_top_srcdir@/doc/aide.db" -c doc/aide.conf -i - -dist-hook: configure - mkdir $(distdir)/include - cp -p include/*.h $(distdir)/include - - mkdir $(distdir)/contrib - cp -p contrib/[a-z]* $(distdir)/contrib - - rm -f $(distdir)/src/conf_yacc.c $(distdir)/src/conf_yacc.h +EXTRA_DIST = version.m4 AUTHORS ChangeLog INSTALL README Todo \ + contrib/bzip2.sh contrib/gpg2_check.sh contrib/gpg2_update.sh \ + contrib/gpg_check.sh contrib/gpg_update.sh contrib/sshaide.sh \ + LICENSE-snprintf.txt README-snprintf diff -urN aide.orig/src/conf_lex.l aide/src/conf_lex.l --- aide.orig/src/conf_lex.l 2010-02-09 15:53:04.000000000 -0500 +++ aide/src/conf_lex.l 2010-02-11 15:53:19.000000000 -0500 @@ -32,13 +32,12 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ +#include "aide.h" #include <string.h> #include "conf_yacc.h" -#include "report.h" #include "list.h" #include "symboltable.h" #include "commandconf.h" -#include "db_config.h" void includehandler(void) ; void conf_put_token(const char*); diff -urN aide.orig/src/db_lex.l aide/src/db_lex.l --- aide.orig/src/db_lex.l 2010-02-09 15:53:04.000000000 -0500 +++ aide/src/db_lex.l 2010-02-11 15:53:19.000000000 -0500 @@ -46,6 +46,7 @@ #define YYDEBUG +#include "aide.h" #include "conf_yacc.h" #include <string.h> #include "report.h" diff -urN aide.orig/src/Makefile.am aide/src/Makefile.am --- aide.orig/src/Makefile.am 2010-02-09 15:53:04.000000000 -0500 +++ aide/src/Makefile.am 2010-02-11 15:53:19.000000000 -0500 @@ -17,61 +17,58 @@ # Boston, MA 02111-1307, USA. # -# This is no longer needed -# SUBDIRS = crypt - bin_PROGRAMS = aide +noinst_HEADERS = conf_yacc.h +BUILT_SOURCES = conf_yacc.h + +AM_YFLAGS= -d +#AM_LFLAGS= -d +LEX_OUTPUT_ROOT = lex.yy -aide_SOURCES = \ +LDADD = -lm @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@ @ATTRLIB@ @ELFLIB@ +AM_CFLAGS = @AIDE_DEFS@ -W -Wall -g + +CLEANFILES = conf_yacc.h conf_yacc.c conf_lex.c db_lex.c *~ + +INCLUDES = -I$(top_srcdir) -I$(top_srcdir)/include -I$(top_srcdir)/src \ + -I$(top_builddir)/src + +aide_SOURCES = aide.c \ + base64.c \ + be.c \ + commandconf.c \ + compare_db.c \ + conf_lex.l \ conf_yacc.y \ - conf_lex2.c \ - getopt.c \ - getopt1.c \ - gnu_regex.c \ - error.c \ - md.c \ db.c \ - commandconf.c \ - db_file.c \ db_disk.c \ - db_lex2.c \ + db_file.c \ + db_lex.l \ + db_list.c \ db_sql.c \ + do_md.c \ + error.c \ + fopen.c \ gen_list.c \ + getopt1.c \ + getopt.c \ + gnu_regex.c \ list.c \ - do_md.c \ - base64.c \ - symboltable.c \ - compare_db.c \ - be.c \ - util.c \ + md.c \ snprintf.c \ - fopen.c \ - aide.c - -INCLUDES = -I$(top_srcdir)/include - -LDADD = -lm @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@ @ATTRLIB@ @ELFLIB@ - -AM_LDFLAGS = @LDFLAGS@ @LD_STATIC_FLAG@ - -AM_CFLAGS = @CFLAGS@ @MAINTAINER_MODE_TRUE@ -Wall -g - -CLEANFILES = conf_yacc.h conf_yacc.c conf_lex.c db_lex.c *~ -LEX_OUTPUT_ROOT = lex.yy - -# AM_YFLAGS= -d + symboltable.c \ + util.c -db_lex2.c:db_lex.c +conf_yacc.c: conf_yacc.y + $(YACC) $(AM_YFLAGS) -o $@ -p conf $< -db_lex.c:db_lex.l - ${LEX} -Pdb -odb_lex.c $(top_srcdir)/src/db_lex.l +conf_lex.c: conf_lex.l conf_yacc.c + $(LEX) $(AM_LFLAGS) -o$@ -Pconf $< -conf_yacc.c:conf_yacc.y - ${YACC} ${YFLAGS} -d -p conf -o conf_yacc.c $(top_srcdir)/src/conf_yacc.y +conf_lex2.c: conf_lex.c -conf_yacc.h: conf_yacc.c +db_lex.c: db_lex.l conf_yacc.h + $(LEX) $(AM_LFLAGS) -o$@ -Pdb $< -conf_lex2.c:conf_lex.c +db_lex2.c: db_lex.c -conf_lex.c:conf_lex.l - ${LEX} -l -Pconf -oconf_lex.c $(top_srcdir)/src/conf_lex.l |