Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] dynamically find librpm.so #21936

Merged
merged 1 commit into from
Oct 20, 2020
Merged

[Auditbeat] dynamically find librpm.so #21936

merged 1 commit into from
Oct 20, 2020

Conversation

leehinman
Copy link
Contributor

@leehinman leehinman commented Oct 16, 2020 •
edited by andresrc
Loading

What does this PR do?

Auditbeat uses librpm to determine
information about installed packages. To do this auditbeat needs to
dlopen the librpm dynamic library. The version number and thus
filename of the library changes over time. Previously we had a list
of acceptable values, but this caused librpm to not be loaded when
there was a new version. This change uses the information in the elf
header of the rpm binary to determine the exact path of librpm (and
thus version) that the rpm binary on the system uses. A fallback of
"librpm.so" is also provided. If systems have the rpm-devel package
installed then this symlink is available.

Why is it important?

Stops us from having to update an accepted list of librpm.so filenames
when new version of rpm based Linux distributions are released.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
    - [ ] I have added tests that prove my fix is effective or that my feature works
    - [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

Install & start auditbeat on systems with and without rpm-devel
installed. Package module should start without errors.

Related issues

@leehinman
dynamically find librpm
382686e 
- use elf header of rpm binary to find version of librpm
- use librpm.so as fallback, provided by rpm-devel

Closes elastic#19287
@leehinman leehinman added enhancement needs_backport PR is waiting to be backported to other branches. Auditbeat Team:SIEM labels Oct 16, 2020
@leehinman leehinman requested a review from a team as a code owner October 16, 2020 20:11
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Oct 16, 2020
@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #21936 opened]

  • Start Time: 2020-10-16T20:12:48.837+0000

  • Duration: 37 min 30 sec

Test stats 🧪

Test Results
Failed 0
Passed 228
Skipped 33
Total 261

@leehinman leehinman merged commit 37dc557 into elastic:master Oct 20, 2020
@leehinman leehinman mentioned this pull request Oct 20, 2020
Merged
2 tasks
@leehinman leehinman added v7.11.0 and removed needs_backport PR is waiting to be backported to other branches. labels Oct 20, 2020
leehinman added a commit to leehinman/beats that referenced this pull request Oct 20, 2020
@leehinman
dynamically find librpm (elastic#21936)
614f274 
- use elf header of rpm binary to find version of librpm
- use librpm.so as fallback, provided by rpm-devel

Closes elastic#19287

(cherry picked from commit 37dc557)
andrewkroh
andrewkroh reviewed Oct 20, 2020
View reviewed changes
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice solution. I don't think I would have ever thought to do this. 👍

x-pack/auditbeat/module/system/package/rpm_linux.go
librpm.handle, err = dlopen.GetHandle(librpmNames)
if err != nil {
return nil, err
return nil, fmt.Errorf("Couldn't open %v", librpmNames)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Error strings should not be capitalized. https://github.com/golang/go/wiki/CodeReviewComments#error-strings

x-pack/auditbeat/module/system/package/rpm_linux.go
"time"
"unsafe"

"debug/elf"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Group this with the other stdlib imports.

v1v added a commit to v1v/beats that referenced this pull request Oct 21, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/windows-10
91e9d54 
* upstream/master:
  feat: package aliases for snapshots (elastic#21960)
  [DOC] Add firewall as possible troubleshooting issue (elastic#21743)
  [Filebeat] Add max_number_of_messages config parameter for S3 input (elastic#21993)
  [Elastic Agent] Fix missing elastic_agent event data  (elastic#21994)
  Document auditbeat system process module config (elastic#21766)
  Update links (elastic#22012)
  dynamically find librpm (elastic#21936)
  Fix Istio docs (elastic#22019)
  [beats-tester][packaging] store packages in another location (elastic#21903)
  [Kubernetes] Remove redundant dockersock volume mount (elastic#22009)
  [Ingest Manager] Always try snapshot repo for agent upgrade (elastic#21951)
  Azure storage metricset values not inside the metricset name (elastic#21845)
  fix diskio and memory bugs under windows (elastic#21992)
  Fix TestDockerStart flaky test (elastic#21681)
  filebeat: add SSL options to checkpoint module (elastic#19560)
  Stop storing stateless kubernetes keystores (elastic#21880)
  [Elastic Agent] Fix named pipe communication on Windows 7 (elastic#21931)
  [Elastic Agent] Fix index for Agent monitoring to to elastic_agent. (elastic#21932)
leehinman added a commit that referenced this pull request Oct 21, 2020
@leehinman
dynamically find librpm (#21936) (#22024)
114058d 
- use elf header of rpm binary to find version of librpm
- use librpm.so as fallback, provided by rpm-devel

Closes #19287

(cherry picked from commit 37dc557)
@leehinman leehinman mentioned this pull request Oct 22, 2020
Merged
1 task
v1v added a commit to v1v/beats that referenced this pull request Oct 22, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/windows-2008
2080cc2 
* upstream/master: (27 commits)
  chore: use ubuntu 18 as linux agent (elastic#22084)
  docs: Prepare Changelog for 7.9.3 (elastic#22073) (elastic#22075)
  docs: Prepare Changelog for 6.8.13 (elastic#22072) (elastic#22079)
  [build][packaging] Add resilience when docker build (elastic#22050)
  Fix the url of reviewdog (elastic#21981)
  revert WSS process reporting for windows (elastic#22055)
  Fix typo (elastic#19585) (elastic#22061)
  [Ingest Manager] Use ML_SYSTEM to detect if agent is running as a service (elastic#21884)
  Prevent log input from sending duplicate messages due to file renaming (elastic#21911)
  feat: package aliases for snapshots (elastic#21960)
  [DOC] Add firewall as possible troubleshooting issue (elastic#21743)
  [Filebeat] Add max_number_of_messages config parameter for S3 input (elastic#21993)
  [Elastic Agent] Fix missing elastic_agent event data  (elastic#21994)
  Document auditbeat system process module config (elastic#21766)
  Update links (elastic#22012)
  dynamically find librpm (elastic#21936)
  Fix Istio docs (elastic#22019)
  [beats-tester][packaging] store packages in another location (elastic#21903)
  [Kubernetes] Remove redundant dockersock volume mount (elastic#22009)
  [Ingest Manager] Always try snapshot repo for agent upgrade (elastic#21951)
  ...
@leehinman leehinman mentioned this pull request Oct 22, 2020
Merged
1 task
@leehinman leehinman deleted the 19287_librpm_discovery branch May 14, 2021 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh left review comments

@marc-gr marc-gr marc-gr approved these changes

Assignees
No one assigned
Labels
Auditbeat enhancement v7.11.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Auditbeat] Make librpm discovery more robust
4 participants
@leehinman @elasticmachine @andrewkroh @marc-gr