From mboxrd@z Thu Jan 1 00:00:00 1970 From: Maupertuis Philippe Subject: SOFTWARE_UPDATE on RHEL 7.6 Date: Wed, 29 Aug 2018 15:53:05 +0200 Message-ID: <3D2AB1326AB2974190FCE3F69401F790010BAE1F13A8@FRVDX103.fr01.awl.atosorigin.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3255729147332394993==" Return-path: Received: from mx1.redhat.com (ext-mx09.extmail.prod.ext.phx2.redhat.com [10.5.110.38]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 38344DA10C for ; Wed, 29 Aug 2018 13:54:15 +0000 (UTC) Received: from smtppost.atos.net (smtppost.atos.net [193.56.114.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 3803A4E4CB for ; Wed, 29 Aug 2018 13:54:12 +0000 (UTC) Content-Language: fr-FR List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============3255729147332394993== Content-Language: fr-FR Content-Type: multipart/alternative; boundary="_000_3D2AB1326AB2974190FCE3F69401F790010BAE1F13A8FRVDX103fr0_" --_000_3D2AB1326AB2974190FCE3F69401F790010BAE1F13A8FRVDX103fr0_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, I have tried to get the SOFTWARE_UPDATE events on a new RHEL 7.6 beta 1 wit= h audit rebased on 2.8.4 When installing a new rpm I get the corresponding event. The text format is very easily readable :) Unfortunately when I remove the package I get nothing. Is it the intending behavior ? If updates are pushed through Redhat satellite or Spacewalk would I get th= e event ? Philippe !!!************************************************************************= ************* "Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage = exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret= professionnel. Si vous recevez ce message par erreur, merci d'en avertir i= mm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouv= ant ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra ?tr= e recherch?e quant au contenu de ce message. Bien que les meilleurs efforts= soient faits pour maintenir cette transmission exempte de tout virus, l'ex= p?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saura= it ?tre recherch?e pour tout dommage r?sultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely= for the addressee; it may also be privileged. If you receive this e-mail i= n error, please notify the sender immediately and destroy it. As its integr= ity cannot be secured on the Internet, the Worldline liability cannot be tr= iggered for the message content. Although the sender endeavours to maintain= a computer virus-free network, the sender does not warrant that this trans= mission is virus-free and will not be liable for any damages resulting from= any virus transmitted.!!!" --_000_3D2AB1326AB2974190FCE3F69401F790010BAE1F13A8FRVDX103fr0_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

I have tried to get the SOFTWAR= E_UPDATE events on a new RHEL 7.6 beta 1 with audit rebased on 2.8.4

When installing a new rpm I get= the corresponding event.

The text format is very easily = readable  J

Unfortunately when I remove the= package I get nothing.

Is it the intending behavior ?<= o:p>

 

If updates are pushed through R= edhat satellite or  Spacewalk would I get the event ?

 

Philippe

 

 


!!!**********************= ***************************************************************
"Ce message et les pièces jointes sont confidentiels et r&eacut= e;servés à l'usage exclusif de ses destinataires. Il peut &ea= cute;galement être protégé par le secret professionnel.= Si vous recevez ce message par erreur, merci d'en avertir immédiate= ment l'expéditeur et de le détruire. L'intégrité du message ne pouvant ê= ;tre assurée sur Internet, la responsabilité de Worldline ne = pourra être recherchée quant au contenu de ce message. Bien qu= e les meilleurs efforts soient faits pour maintenir cette transmission exem= pte de tout virus, l'expéditeur ne donne aucune garantie à cet ég= ard et sa responsabilité ne saurait être recherchée pou= r tout dommage résultant d'un virus transmis.

This e-mail and the documents attached are confidential and intended solely= for the addressee; it may also be privileged. If you receive this e-mail i= n error, please notify the sender immediately and destroy it. As its integr= ity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Altho= ugh the sender endeavours to maintain a computer virus-free network, the se= nder does not warrant that this transmission is virus-free and will not be = liable for any damages resulting from any virus transmitted.!!!"
 --_000_3D2AB1326AB2974190FCE3F69401F790010BAE1F13A8FRVDX103fr0_-- --===============3255729147332394993== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3255729147332394993==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: SOFTWARE_UPDATE on RHEL 7.6 Date: Wed, 29 Aug 2018 14:34:39 -0400 Message-ID: <1601219.lEonBTiIkC@x2> References: <3D2AB1326AB2974190FCE3F69401F790010BAE1F13A8@FRVDX103.fr01.awl.atosorigin.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3D2AB1326AB2974190FCE3F69401F790010BAE1F13A8@FRVDX103.fr01.awl.atosorigin.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Maupertuis Philippe List-Id: linux-audit@redhat.com Hello, On Wednesday, August 29, 2018 9:53:05 AM EDT Maupertuis Philippe wrote: > I have tried to get the SOFTWARE_UPDATE events on a new RHEL 7.6 beta 1 > with audit rebased on 2.8.4 When installing a new rpm I get the > corresponding event. > The text format is very easily readable :) > Unfortunately when I remove the package I get nothing. > Is it the intending behavior ? Yes. That is the intended behavior. If package removal events are desired, a bug report may be filed. OSPP v4.2 requirements are concerned about software being installed and upgraded. It is silent on software removal. > If updates are pushed through Redhat satellite or Spacewalk would I get > the event ? The patch is in librpm, so it should be recorded by anything that uses it. -Steve