From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A9F7515802E for ; Mon, 24 Jun 2024 20:08:26 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id C9E3EE2A68; Mon, 24 Jun 2024 20:08:25 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9FC62E2A68 for ; Mon, 24 Jun 2024 20:08:25 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A6226340988 for ; Mon, 24 Jun 2024 20:08:24 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 200471D32 for ; Mon, 24 Jun 2024 20:08:23 +0000 (UTC) From: "Maciej Barć" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Maciej Barć" Message-ID: <1719259699.674ec4fbbe6745ff3a18e57fcbda464874495538.xgqt@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-admin/rsyslog/, app-admin/rsyslog/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-admin/rsyslog/files/50-default-r2.conf app-admin/rsyslog/files/README.gentoo-r1 app-admin/rsyslog/rsyslog-8.2404.0-r1.ebuild X-VCS-Directories: app-admin/rsyslog/ app-admin/rsyslog/files/ X-VCS-Committer: xgqt X-VCS-Committer-Name: Maciej Barć X-VCS-Revision: 674ec4fbbe6745ff3a18e57fcbda464874495538 X-VCS-Branch: master Date: Mon, 24 Jun 2024 20:08:23 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: f7078fff-55f2-432b-82f9-cfd7b90beb67 X-Archives-Hash: 2c97bddc1ef7a200d7e2f70d1a4cea58 commit: 674ec4fbbe6745ff3a18e57fcbda464874495538 Author: Maciej Barć gentoo org> AuthorDate: Mon Jun 24 19:26:15 2024 +0000 Commit: Maciej Barć gentoo org> CommitDate: Mon Jun 24 20:08:19 2024 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=674ec4fb app-admin/rsyslog: remove /var/empty/dev/log sock Signed-off-by: Maciej Barć gentoo.org> app-admin/rsyslog/files/50-default-r2.conf | 103 ++++++ app-admin/rsyslog/files/README.gentoo-r1 | 39 ++ app-admin/rsyslog/rsyslog-8.2404.0-r1.ebuild | 509 +++++++++++++++++++++++++++ 3 files changed, 651 insertions(+) diff --git a/app-admin/rsyslog/files/50-default-r2.conf b/app-admin/rsyslog/files/50-default-r2.conf new file mode 100644 index 000000000000..07f27b6820a1 --- /dev/null +++ b/app-admin/rsyslog/files/50-default-r2.conf @@ -0,0 +1,103 @@ +####################### +### DEFAULT ACTIONS ### +####################### + +auth,authpriv.* action( + name="action_auth" + type="omfile" + File="/var/log/auth.log" + FileCreateMode="0600" + FileOwner="root" + FileGroup="adm" + Sync="off" +) + +cron.* action( + name="action_cron" + type="omfile" + File="/var/log/cron.log" + FileOwner="root" + FileGroup="adm" +) + +daemon.* action( + name="action_daemon" + type="omfile" + File="/var/log/daemon.log" + FileOwner="root" + FileGroup="adm" +) + +kern.* action( + name="action_kern" + type="omfile" + File="/var/log/kern.log" + FileOwner="root" + FileGroup="adm" +) + +lpr.* action( + name="action_lpr" + type="omfile" + File="/var/log/lpr.log" + FileOwner="root" + FileGroup="adm" +) + +mail.* action( + name="action_mail" + type="omfile" + File="/var/log/mail.log" + FileOwner="root" + FileGroup="adm" +) + +news.* action( + name="action_news" + type="omfile" + File="/var/log/news.log" + FileOwner="root" + FileGroup="adm" +) + +user.* action( + name="action_user" + type="omfile" + File="/var/log/user.log" + FileOwner="root" + FileGroup="adm" +) + +*.=debug;auth,authpriv,news,mail.none action( + name="action_debug" + type="omfile" + File="/var/log/debug.log" + FileOwner="root" + FileGroup="adm" +) + +*.info;auth,authpriv,cron,daemon,lpr,mail,news.none action( + name="action_messages" + type="omfile" + File="/var/log/messages" + FileOwner="root" + FileGroup="adm" +) + +# Uncomment the following directive to re-enable the +# deprecated "/var/log/syslog" log file (don't forget to re-enable log +# rotation in "/etc/logrotate.d/rsyslog" if you do that!) +#*.*;auth,authpriv.none action( +# name="action_syslog" +# type="omfile" +# File="/var/log/syslog" +# FileOwner="root" +# FileGroup="adm" +#) + +*.emerg action( + name="action_emerge" + type="omusrmsg" + Users="*" + action.execOnlyOnceEveryInterval="10" +) diff --git a/app-admin/rsyslog/files/README.gentoo-r1 b/app-admin/rsyslog/files/README.gentoo-r1 new file mode 100644 index 000000000000..98f63a39cada --- /dev/null +++ b/app-admin/rsyslog/files/README.gentoo-r1 @@ -0,0 +1,39 @@ +Introduction +============ + +Since rsyslog version 7.6 we are shipping a new default Gentoo +configuration. See bug #501982 to learn more about what we were trying to +achieve by rewriting the entire configuration. + + +Important changes +================= + +1. "/var/log/syslog" log file is now deprecated + + Beginning with rsyslog-7.6, the "/var/log/syslog" log file will no + longer being written per default. We are considering this file as + deprecated/obsolet for the typical user/system. + The content from this log file is still availble through other + (dedicated) log files, see + + - /var/log/cron.log + - /var/log/daemon.log + - /var/log/mail.log + - /var/log/messages + + If you really need the old "/var/log/syslog" log file, all you have to + do is uncommenting the corresponding configuration directive in + "/etc/rsyslog.d/50-default.conf". + + If you do so, don't forget to re-enable log rotation in + "/etc/logrotate.d/rsyslog", too. + + +2. "/var/empty/dev/log" no longer default + + Before version 8.2404.0-r1 there was an additional input socket in + "/var/empty/dev/log" (default chroot location) in 8.2404.0-r1 that socket + was removed form the default configuration. Users can enable that socket + if they need to on their own but it shouldn't be necessary when running new + versions of openssh. diff --git a/app-admin/rsyslog/rsyslog-8.2404.0-r1.ebuild b/app-admin/rsyslog/rsyslog-8.2404.0-r1.ebuild new file mode 100644 index 000000000000..514cb65782b2 --- /dev/null +++ b/app-admin/rsyslog/rsyslog-8.2404.0-r1.ebuild @@ -0,0 +1,509 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{10..12} ) + +inherit autotools linux-info python-any-r1 systemd + +DESCRIPTION="An enhanced multi-threaded syslogd with database support and more" +HOMEPAGE="https://www.rsyslog.com/ + https://github.com/rsyslog/rsyslog/" + +if [[ "${PV}" == *9999* ]]; then + EGIT_REPO_URI="https://github.com/rsyslog/${PN}.git" + DOC_REPO_URI="https://github.com/rsyslog/${PN}-doc.git" + + inherit git-r3 +else + SRC_URI=" + https://www.rsyslog.com/files/download/${PN}/${P}.tar.gz + doc? ( + https://www.rsyslog.com/files/download/${PN}/${PN}-doc-${PV}.tar.gz + ) + " + + KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc64 ~riscv ~sparc ~x86" +fi + +LICENSE="GPL-3 LGPL-3 Apache-2.0" +SLOT="0" + +IUSE="clickhouse curl dbi debug doc elasticsearch +gcrypt gnutls imhttp" +IUSE+=" impcap jemalloc kafka kerberos kubernetes mdblookup" +IUSE+=" mongodb mysql normalize omhttp omhttpfs omudpspoof +openssl" +IUSE+=" postgres rabbitmq redis relp rfc3195 rfc5424hmac snmp +ssl" +IUSE+=" systemd test usertools +uuid xxhash zeromq" + +RESTRICT="!test? ( test )" + +REQUIRED_USE=" + kubernetes? ( normalize ) + ssl? ( || ( gnutls openssl ) ) +" + +BDEPEND=">=dev-build/autoconf-archive-2015.02.24 + sys-apps/lsb-release + virtual/pkgconfig + test? ( + jemalloc? ( /dev/null; then + die "certtool not found! Is net-libs/gnutls[tools] is installed?" + fi + + # Make sure the certificates directory exists + local CERTDIR="${EROOT}/etc/ssl/${PN}" + if [[ ! -d "${CERTDIR}" ]]; then + mkdir "${CERTDIR}" || die + fi + einfo "Your certificates will be stored in ${CERTDIR}" + + # Create a default CA if needed + if [[ ! -f "${CERTDIR}/${PN}_ca.cert.pem" ]]; then + einfo "No CA key and certificate found in ${CERTDIR}, creating them for you..." + certtool --generate-privkey \ + --outfile "${CERTDIR}/${PN}_ca.privkey.pem" || die + chmod 400 "${CERTDIR}/${PN}_ca.privkey.pem" + + cat > "${T}/${PF}.$$" <<- _EOF + cn = Portage automated CA + ca + cert_signing_key + expiration_days = 3650 + _EOF + + certtool --generate-self-signed \ + --load-privkey "${CERTDIR}/${PN}_ca.privkey.pem" \ + --outfile "${CERTDIR}/${PN}_ca.cert.pem" \ + --template "${T}/${PF}.$$" || die + chmod 400 "${CERTDIR}/${PN}_ca.privkey.pem" + + # Create the server certificate + echo + einfon "Please type the Common Name of the SERVER you wish to create a certificate for: " + read -r CN + + einfo "Creating private key and certificate for server ${CN}..." + certtool --generate-privkey \ + --outfile "${CERTDIR}/${PN}_${CN}.key.pem" || die + chmod 400 "${CERTDIR}/${PN}_${CN}.key.pem" + + cat > "${T}/${PF}.$$" <<- _EOF + cn = ${CN} + tls_www_server + dns_name = ${CN} + expiration_days = 3650 + _EOF + + certtool --generate-certificate \ + --outfile "${CERTDIR}/${PN}_${CN}.cert.pem" \ + --load-privkey "${CERTDIR}/${PN}_${CN}.key.pem" \ + --load-ca-certificate "${CERTDIR}/${PN}_ca.cert.pem" \ + --load-ca-privkey "${CERTDIR}/${PN}_ca.privkey.pem" \ + --template "${T}/${PF}.$$" &>/dev/null + chmod 400 "${CERTDIR}/${PN}_${CN}.cert.pem" + + else + einfo "Found existing ${CERTDIR}/${PN}_ca.cert.pem, skipping CA and SERVER creation." + fi + + # Create a client certificate + echo + einfon "Please type the Common Name of the CLIENT you wish to create a certificate for: " + read -r CN + + einfo "Creating private key and certificate for client ${CN}..." + certtool --generate-privkey \ + --outfile "${CERTDIR}/${PN}_${CN}.key.pem" || die + chmod 400 "${CERTDIR}/${PN}_${CN}.key.pem" + + cat > "${T}/${PF}.$$" <<- _EOF + cn = ${CN} + tls_www_client + dns_name = ${CN} + expiration_days = 3650 + _EOF + + certtool --generate-certificate \ + --outfile "${CERTDIR}/${PN}_${CN}.cert.pem" \ + --load-privkey "${CERTDIR}/${PN}_${CN}.key.pem" \ + --load-ca-certificate "${CERTDIR}/${PN}_ca.cert.pem" \ + --load-ca-privkey "${CERTDIR}/${PN}_ca.privkey.pem" \ + --template "${T}/${PF}.$$" || die + chmod 400 "${CERTDIR}/${PN}_${CN}.cert.pem" + + rm -f "${T}/${PF}.$$" + + echo + einfo "Here is the documentation on how to encrypt your log traffic:" + einfo " https://www.rsyslog.com/doc/rsyslog_tls.html" +}