diff --git a/NEWS b/NEWS index d49578f80611225a29b2c01cadb744b685b16b95..d423cb2add7f9ed158ff1d8abeff793f316080de 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,10 @@ +release/001.010 (2015-08-03) + + Disable 'simplify' mode on RHEL/CentOS5, regardless of + setting override, due to unmet dependency of + perl-POSIX-strptime (would have to edit the 3rd party + auditd simplify perl code to make compatible) (jlent) + release/001.009 (2015-07-31) Remove ANOTHER duplicate line from audit.rules (adamhl) diff --git a/manifests/auditd.pp b/manifests/auditd.pp index 718e31bd241f7e88f3369ef900fbcd9b06a15d87..f9014485407c16b5e95e80e60f4e068cfda4cce0 100644 --- a/manifests/auditd.pp +++ b/manifests/auditd.pp @@ -79,8 +79,14 @@ define audit::auditd ( } # Test the simplification of auditd logging - if $simplify == 'NONE' { - package { 'stanford-auditd-tools': ensure => absent } + # The 'simplify' plugin has a dependency of perl-POSIX-strptime that is + # not met on RHEL/CentOS5; quietly disabling 'simplify' in that case + if ($simplify == 'NONE' or ($::osfamily == 'RedHat' and $::lsbmajdistrelease == '5')) { + if ($::osfamily == 'RedHat' and $::lsbmajdistrelease == '5') { + # do nothing - package is not available in repos + } else { + package { 'stanford-auditd-tools': ensure => absent } + } file { '/etc/audisp/plugins.d/simplify.conf': ensure => absent; '/etc/newsyslog.daily/audisp-simplify': ensure => absent; @@ -99,7 +105,7 @@ define audit::auditd ( source => "$afile/etc/audisp/plugins.d/simplify.conf", require => Package['auditd']; '/etc/newsyslog.daily/audisp-simplify': - mode => 644, + mode => '0644', source => "$afile/etc/newsyslog.daily/audisp-simplify", require => Package['newsyslog']; }