libauparse exporting clear_config()

libauparse exporting clear_config()

[Laurent Bigonville]

Hello,

With 2.3.5, libauparse is exporting a new symbol (clear_config())

It seems that all the other symbols are prefixed with either auparse_
or audit_, so is this expected?

Cheers,

Laurent Bigonville

Output of some debian tools:
--- debian/libauparse0.symbols (libauparse0_1:2.3.5-1_amd64)
+++ dpkg-gensymbols5cm36h       2014-04-08 17:59:09.324337637 +0000
@@ -43,3 +43,4 @@
  ausearch_clear@Base 1:2.2.1
  ausearch_next_event@Base 1:2.2.1
  ausearch_set_stop@Base 1:2.2.1
+ clear_config@Base 1:2.3.5-1

Re: libauparse exporting clear_config()

[Steve Grubb]

On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> With 2.3.5, libauparse is exporting a new symbol (clear_config())
> 
> It seems that all the other symbols are prefixed with either auparse_
> or audit_, so is this expected?

No, this was not expected. It should be an internal use only function. Is this 
causing any symbol collision in a known program?

Thanks,
-Steve

Re: libauparse exporting clear_config()

[Laurent Bigonville]

Le Thu, 10 Apr 2014 07:25:42 -0400,
Steve Grubb <sgrubb@redhat.com> a écrit :

> On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> > With 2.3.5, libauparse is exporting a new symbol (clear_config())
> > 
> > It seems that all the other symbols are prefixed with either
> > auparse_ or audit_, so is this expected?
> 
> No, this was not expected. It should be an internal use only
> function. Is this causing any symbol collision in a known program?

Searching[0] quickly in the code that is present in the debian archive,
I see that at least lxc has the same function name, but I didn't
encounter collision myself.

Apparently libaudit also has some symbols that are not prefixed
by audit_[1], but these seems a bit less generic than "clear_config()"

Cheers,

Laurent Bigonville

[0] http://codesearch.debian.net/
[1]
http://anonscm.debian.org/gitweb/?p=collab-maint/audit.git;a=blob;f=debian/libaudit1.symbols;h=1d1af3e008ab7858b3e6996563a9a9a5b4aa7723;hb=HEAD

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: libauparse exporting clear_config()

[Steve Grubb]

On Friday, April 11, 2014 08:54:37 AM Laurent Bigonville wrote:
> Le Thu, 10 Apr 2014 07:25:42 -0400,
> 
> Steve Grubb <sgrubb@redhat.com> a écrit :
> > On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> > > With 2.3.5, libauparse is exporting a new symbol (clear_config())
> > > 
> > > It seems that all the other symbols are prefixed with either
> > > auparse_ or audit_, so is this expected?
> > 
> > No, this was not expected. It should be an internal use only
> > function. Is this causing any symbol collision in a known program?
> 
> Searching[0] quickly in the code that is present in the debian archive,
> I see that at least lxc has the same function name, but I didn't
> encounter collision myself.

Thanks for checking this. I don't think lxr would be using auparse, so I think 
we are safe. That said, the fix is to add the following:

void clear_config(struct daemon_conf *config) hidden;

to auparse/internal.h and then recompile. It's already in svn and will be in 
the next release, which should be in the next week or so.


> Apparently libaudit also has some symbols that are not prefixed
> by audit_[1], but these seems a bit less generic than "clear_config()"

Thanks. I don't see anything here likely to cause a collision.

-Steve

> [0] http://codesearch.debian.net/
> [1]
> http://anonscm.debian.org/gitweb/?p=collab-maint/audit.git;a=blob;f=debian/l
> ibaudit1.symbols;h=1d1af3e008ab7858b3e6996563a9a9a5b4aa7723;hb=HEAD

Re: libauparse exporting clear_config()

[Laurent Bigonville]

Le Fri, 11 Apr 2014 09:42:50 -0400,
Steve Grubb <sgrubb@redhat.com> a écrit :

> On Friday, April 11, 2014 08:54:37 AM Laurent Bigonville wrote:
> > Le Thu, 10 Apr 2014 07:25:42 -0400,
> > 
> > Steve Grubb <sgrubb@redhat.com> a écrit :
> > > On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> > > > With 2.3.5, libauparse is exporting a new symbol
> > > > (clear_config())
> > > > 
> > > > It seems that all the other symbols are prefixed with either
> > > > auparse_ or audit_, so is this expected?
> > > 
> > > No, this was not expected. It should be an internal use only
> > > function. Is this causing any symbol collision in a known program?
> > 
> > Searching[0] quickly in the code that is present in the debian
> > archive, I see that at least lxc has the same function name, but I
> > didn't encounter collision myself.
> 
> Thanks for checking this. I don't think lxr would be using auparse,
> so I think we are safe. That said, the fix is to add the following:
> 
> void clear_config(struct daemon_conf *config) hidden;
> 
> to auparse/internal.h and then recompile. It's already in svn and
> will be in the next release, which should be in the next week or so.
> 

Thanks!

Something else somehow related, I just received a bugreport about the
load_config() function being declared in both auditd core and the
prelude plugin https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744282

Cheers,

Laurent Bigonville

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: libauparse exporting clear_config()

[Steve Grubb]

On Saturday, April 12, 2014 02:46:38 PM Laurent Bigonville wrote:
> Le Fri, 11 Apr 2014 09:42:50 -0400,
> 
> Steve Grubb <sgrubb@redhat.com> a écrit :
> > On Friday, April 11, 2014 08:54:37 AM Laurent Bigonville wrote:
> > > Le Thu, 10 Apr 2014 07:25:42 -0400,
> > > 
> > > Steve Grubb <sgrubb@redhat.com> a écrit :
> > > > On Thursday, April 10, 2014 09:06:11 AM Laurent Bigonville wrote:
> > > > > With 2.3.5, libauparse is exporting a new symbol
> > > > > (clear_config())
> > > > > 
> > > > > It seems that all the other symbols are prefixed with either
> > > > > auparse_ or audit_, so is this expected?
> > > > 
> > > > No, this was not expected. It should be an internal use only
> > > > function. Is this causing any symbol collision in a known program?
> > > 
> > > Searching[0] quickly in the code that is present in the debian
> > > archive, I see that at least lxc has the same function name, but I
> > > didn't encounter collision myself.
> > 
> > Thanks for checking this. I don't think lxr would be using auparse,
> > so I think we are safe. That said, the fix is to add the following:
> > 
> > void clear_config(struct daemon_conf *config) hidden;
> > 
> > to auparse/internal.h and then recompile. It's already in svn and
> > will be in the next release, which should be in the next week or so.
> 
> Thanks!
> 
> Something else somehow related, I just received a bugreport about the
> load_config() function being declared in both auditd core and the
> prelude plugin https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744282

Something seems wrong with that report. the prelude plugin and auditd are two 
entirely different programs. But looking deeper, I wonder if what they meant 
was that the prelude plugin links with auparse which uses the visibility 
settings to hide a load_config function from the ABI?

-Steve