updated OSSEC version to 3.6.0, built with JIT disabled for grsec kernel

compatibility
freedomofpress · Apr 20, 2020 · 058188b · 058188b
1 parent bc06d98
commit 058188b
Show file tree

Hide file tree

Showing 17 changed files with 53 additions and 24 deletions.
diff --git a/docs/development/release_management.rst b/docs/development/release_management.rst
@@ -82,7 +82,7 @@ Pre-Release
    <https://github.com/freedomofpress/securedrop-dev-packages-lfs>`_.
    Only commit packages with an incremented version number: do not
    clobber existing packages.  That is, if there is already a deb
-   called e.g. ``ossec-agent-3.0.0-amd64.deb`` in ``master``, do not
+   called e.g. ``ossec-agent-3.6.0-amd64.deb`` in ``master``, do not
    commit a new version of this deb. Changes merged to ``master`` in
    this repo will be published within 15 minutes.
 

diff --git a/install_files/ansible-base/group_vars/securedrop_application_server.yml b/install_files/ansible-base/group_vars/securedrop_application_server.yml
@@ -8,9 +8,9 @@ ip_info:
 local_deb_packages:
   - "securedrop-keyring-0.1.3+{{ securedrop_app_code_version }}-amd64.deb"
   - "securedrop-config-0.1.3+{{ securedrop_app_code_version }}-amd64.deb"
-  - "securedrop-ossec-agent-3.0.0+{{ securedrop_app_code_version }}-amd64.deb"
+  - "securedrop-ossec-agent-3.6.0+{{ securedrop_app_code_version }}-amd64.deb"
   - "{{ securedrop_app_code_deb }}.deb"
-  - "ossec-agent-3.0.0-amd64.deb"
+  - "ossec-agent-3.6.0-amd64.deb"
 
 # Configuring the tor Onion Services
 tor_instances:

diff --git a/install_files/ansible-base/group_vars/securedrop_monitor_server.yml b/install_files/ansible-base/group_vars/securedrop_monitor_server.yml
@@ -8,8 +8,8 @@ ip_info:
 local_deb_packages:
   - "securedrop-keyring-0.1.3+{{ securedrop_app_code_version }}-amd64.deb"
   - "securedrop-config-0.1.3+{{ securedrop_app_code_version }}-amd64.deb"
-  - "securedrop-ossec-server-3.0.0+{{ securedrop_app_code_version }}-amd64.deb"
-  - ossec-server-3.0.0-amd64.deb
+  - "securedrop-ossec-server-3.6.0+{{ securedrop_app_code_version }}-amd64.deb"
+  - ossec-server-3.6.0-amd64.deb
 
 # Configure the tor Onion Services. The Monitor server has only one,
 # for SSH, since no web interfaces.

diff --git a/install_files/ansible-base/roles/build-ossec-deb-pkg/defaults/main.yml b/install_files/ansible-base/roles/build-ossec-deb-pkg/defaults/main.yml
@@ -1,8 +1,8 @@
 ---
-build_ossec_deb_pkg_dependencies: []
+build_ossec_deb_pkg_dependencies: ['libevent1-dev','libpcre2-dev']
 
 ossec_server_hostname: ossec-server
-ossec_version: 3.0.0
+ossec_version: 3.6.0
 # Parent directory for performing build operations. All files related
 # to build, including source tarball, will be created inside this dir.
 build_path: /tmp/build
@@ -22,4 +22,4 @@ ossec_build_rsync_generic_opts:
 ossec_build_rsync_ansible_hack_opt:
   - "--rsync-path='sudo rsync'"
 
-ossec_source_checksum: sha256:a271d665ed502b3df4ff055a177159dfc0bc8a69dd44eab1f7c57fe8fff42a98
+ossec_source_checksum: sha256:653828a19137b8a7e98af65e873318f7bb48137fe1e61b80577e13c316e04708
diff --git a/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py b/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py
@@ -14,7 +14,7 @@
   ossec_version:
     description:
       - version number of release to download
-    default: "3.0.0"
+    default: "3.6.0"
     required: no
 notes:
   - The OSSEC version to download is hardcoded to avoid surprises.
@@ -23,7 +23,7 @@
 '''
 EXAMPLES = '''
 - ossec_urls:
-    ossec_version: "3.0.0"
+    ossec_version: "3.6.0"
 '''
 
 
@@ -68,7 +68,7 @@ def ossec_signature_filename(self):
 def main():
     module = AnsibleModule(  # noqa: F405
         argument_spec=dict(
-            ossec_version=dict(default="3.0.0"),
+            ossec_version=dict(default="3.6.0"),
         ),
         supports_check_mode=False
     )

diff --git a/install_files/ansible-base/roles/build-ossec-deb-pkg/tasks/main.yml b/install_files/ansible-base/roles/build-ossec-deb-pkg/tasks/main.yml
@@ -76,6 +76,12 @@
     src: "{{ purpose }}-preloaded-vars.conf"
     dest: /tmp/ossec-hids-{{ ossec_version }}/etc/preloaded-vars.conf
 
+- name: Disable JIT in OSSEC Makefile
+  lineinfile:
+    path: /tmp/ossec-hids-{{ ossec_version }}/src/Makefile
+    regexp: '^USE_PCRE2_JIT=yes$'
+    line: 'USE_PCRE2_JIT=no'
+
 - name: Run OSSEC installer script on extracted source.
   command: /tmp/ossec-hids-{{ ossec_version }}/install.sh
 

diff --git a/install_files/ossec-agent/etc/ossec-init.conf b/install_files/ossec-agent/etc/ossec-init.conf
@@ -1,4 +1,4 @@
 DIRECTORY="/var/ossec"
-VERSION="v3.0.0"
-DATE="Tue Aug 21 10:52:11 PDT 2018"
+VERSION="v3.6.0"
+DATE="Mon Apr 13 14:41:37 EST 2020"
 TYPE="agent"
diff --git a/install_files/ossec-agent/usr/share/doc/ossec-agent/changelog.Debian b/install_files/ossec-agent/usr/share/doc/ossec-agent/changelog.Debian
@@ -1,3 +1,10 @@
+ossec-agent (3.6.0) unstable; urgency=low
+
+  [ SecureDrop Team ]
+  * Release Notes https://github.com/ossec/ossec-hids/releases/tag/3.6.0
+
+ -- SecureDrop Team <[email protected]>  Mon, 13 Apr 2020 14:53:21 -0400
+
 ossec-agent (3.0.0) unstable; urgency=low
 
   [ SecureDrop Team ]

diff --git a/install_files/ossec-server/etc/ossec-init.conf b/install_files/ossec-server/etc/ossec-init.conf
@@ -1,4 +1,4 @@
 DIRECTORY="/var/ossec"
-VERSION="v3.0.0"
-DATE="Tue Aug 21 10:52:11 PDT 2018"
+VERSION="v3.6.0"
+DATE="Mon Apr 13 15:15:11 EST 2020"
 TYPE="server"
diff --git a/install_files/ossec-server/usr/share/doc/ossec-server/changelog.Debian b/install_files/ossec-server/usr/share/doc/ossec-server/changelog.Debian
@@ -1,3 +1,10 @@
+ossec-server (3.6.0) unstable; urgency=low
+
+  [ SecureDrop Team ]
+  * Release Notes https://github.com/ossec/ossec-hids/releases/tag/3.6.0
+
+ -- SecureDrop Team <[email protected]>  Mon, 13 Apr 2020 15:22:54 -0400
+
 ossec-server (3.0.0) unstable; urgency=low
 
   [ SecureDrop Team ]

diff --git a/install_files/securedrop-ossec-agent/DEBIAN/control b/install_files/securedrop-ossec-agent/DEBIAN/control
@@ -4,9 +4,9 @@ Priority: optional
 Maintainer: SecureDrop Team <[email protected]>
 Homepage: https://securedrop.org
 Package: securedrop-ossec-agent
-Version: 3.0.0+1.3.0~rc1
+Version: 3.6.0+1.3.0~rc1
 Architecture: amd64
-Depends: ossec-agent,securedrop-keyring,securedrop-config
+Depends: libevent-1.4-2,libpcre2-8-0,ossec-agent,securedrop-keyring,securedrop-config
 Replaces: ossec-agent
 Conflicts: securedrop-ossec-server
 Description: Installs the securedrop pre-configured OSSEC agent

diff --git a/install_files/securedrop-ossec-agent/usr/share/doc/securedrop-ossec-agent/changelog.Debian b/install_files/securedrop-ossec-agent/usr/share/doc/securedrop-ossec-agent/changelog.Debian
@@ -1,3 +1,9 @@
+securedrop-ossec-agent (3.6.0) unstable; urgency=low
+
+  * Upgrade to ossec 3.6.0
+
+ -- SecureDrop Team <[email protected]>  Mon, 13 Apr 2020 15:20:12 -0400
+
 securedrop-ossec-agent (3.0.0) unstable; urgency=low
 
   * Upgrade to ossec 3.0

diff --git a/install_files/securedrop-ossec-server/DEBIAN/control b/install_files/securedrop-ossec-server/DEBIAN/control
@@ -4,9 +4,9 @@ Priority: optional
 Maintainer: SecureDrop Team <[email protected]>
 Homepage: https://securedrop.org
 Package: securedrop-ossec-server
-Version: 3.0.0+1.3.0~rc1
+Version: 3.6.0+1.3.0~rc1
 Architecture: amd64
-Depends: ossec-server,securedrop-keyring,securedrop-config
+Depends: libevent-1.4-2,libpcre2-8-0,ossec-server,securedrop-keyring,securedrop-config
 Replaces: ossec-server
 Conflicts: securedrop-ossec-agent
 Description: Installs the pre-packaged OSSEC server

diff --git a/install_files/securedrop-ossec-server/DEBIAN/postinst b/install_files/securedrop-ossec-server/DEBIAN/postinst
@@ -18,6 +18,7 @@ set -x
 
 case "$1" in
     configure)
+
         GROUP="ossec"
         OSSEC_HOME="/var/ossec"
 

diff --git a/install_files/securedrop-ossec-server/usr/share/doc/securedrop-ossec-server/changelog.Debian b/install_files/securedrop-ossec-server/usr/share/doc/securedrop-ossec-server/changelog.Debian
@@ -1,3 +1,9 @@
+securedrop-ossec-agent (3.6.0) unstable; urgency=low
+
+  * Upgrade to ossec 3.60
+
+ -- SecureDrop Team <[email protected]>  Mon, 13 Apr 2020 15:15:32 -0400
+
 securedrop-ossec-agent (3.0.0) unstable; urgency=low
 
   * Upgrade to ossec 3.0

diff --git a/molecule/builder-xenial/tests/test_securedrop_deb_package.py b/molecule/builder-xenial/tests/test_securedrop_deb_package.py
@@ -401,9 +401,7 @@ def test_ossec_binaries_are_present_agent(host, deb):
             "/var/ossec/bin/ossec-syscheckd",
             "/var/ossec/bin/ossec-agentd",
             "/var/ossec/bin/manage_agents",
-            "/var/ossec/bin/ossec-lua",
             "/var/ossec/bin/ossec-control",
-            "/var/ossec/bin/ossec-luac",
             "/var/ossec/bin/ossec-logcollector",
             "/var/ossec/bin/util.sh",
             "/var/ossec/bin/ossec-execd",
@@ -433,13 +431,11 @@ def test_ossec_binaries_are_present_server(host, deb):
             "/var/ossec/bin/ossec-reportd",
             "/var/ossec/bin/ossec-agentlessd",
             "/var/ossec/bin/manage_agents",
-            "/var/ossec/bin/ossec-lua",
             "/var/ossec/bin/rootcheck_control",
             "/var/ossec/bin/ossec-control",
             "/var/ossec/bin/ossec-dbd",
             "/var/ossec/bin/ossec-csyslogd",
             "/var/ossec/bin/ossec-regex",
-            "/var/ossec/bin/ossec-luac",
             "/var/ossec/bin/agent_control",
             "/var/ossec/bin/ossec-monitord",
             "/var/ossec/bin/clear_stats",

diff --git a/molecule/builder-xenial/tests/vars.yml b/molecule/builder-xenial/tests/vars.yml
@@ -1,6 +1,6 @@
 ---
 securedrop_version: "1.3.0~rc1"
-ossec_version: "3.0.0"
+ossec_version: "3.6.0"
 keyring_version: "0.1.3"
 config_version: "0.1.3"
 grsec_version: "4.14.175"