From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mr Dash Four Subject: Re: excluding auditd events Date: Thu, 26 May 2011 16:22:51 +0100 Message-ID: <4DDE704B.1070906@googlemail.com> References: <4DDD9D3E.8020001@googlemail.com> <201105261016.13760.sgrubb@redhat.com> <4DDE624D.6010405@googlemail.com> <201105261033.11536.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <201105261033.11536.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com > The audit package has no dependency on perl. > Oops, sorry, I meant python! My bad! [rant] The other dependency I can't overcome (which I could not remember the other day when the same issue popped up during our discussion Steve) was the libprelude-devel package, simply because in the way the current libprelude-devel package is configured, there is no way on gods green Earth I could install both i686 and x86_64 versions of the tool to enable cross-compilation. There are hardcoded lib paths in "/usr/bin/libprelude-config" ("libdirs=-L/usr/lib" in the i686 version, while "libdirs=-L/usr/lib64" in the x86_64 version) which are obviously arch-dependent. Not to mention this little gem in prelude-intttypes.h - "#define __PRELUDE_HAVE_64BIT_LONG", which is commented out in the i686 version, instead of using a much-more sensible approach and either 1) define these variables depending on the current arch used for compilation - i.e. the "--target" value used in rpmbuild for example; or 2) use two completely separate versions of these files (say libprelude-config- and prelude-inttypes-.h) and integrate those in the pkgconfig files. All this is a classic example of careless programming in my view! [/rant] Without libprelude-devel I can't compile/build audispd-plugins, without audispd-plugins I can't have remote logging in auditd (you get the picture!).