-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/14/2013 09:26 AM, Maura Dailey wrote:
I *could*, but that's hundreds of packages, which may or may not
be installed on any given system. It also doesn't include packages
that might be available through EPEL or configuration files that
people code by hand. The real problem is detecting and resolving
templating. If that hard problem is solved, any number of files in
rsyslog.d could be vacuumed up. I don't think I'm the one to do it,
since I'm about at the limit of my regex skills, and I'm skeptical
that OVAL is up to the challenge either. (The rsyslog package
doesn't include the file you referred to, according to rpm -ql. We
don't run spice agent on our computers, which is no doubt why we
don't have it.)
- Maura Dailey
It's only 3.5 gigs for the base RPMS, here's the results, first block
is files included, second set is part of the scripts that talk to
/var/log (just grep'ed), note many of these are dirs and would have
files created within them:
389-ds-base-1.2.11.15-11.el6.x86_64.rpm.list:/var/log/dirsrv
aide-0.14-3.el6_2.2.x86_64.rpm.list:/var/log/aide
amanda-2.6.1p2-8.el6.i686.rpm.list:/var/log/amanda
amanda-2.6.1p2-8.el6.x86_64.rpm.list:/var/log/amanda
audit-2.2-2.el6.x86_64.rpm.list:/var/log/audit
bacula-common-5.0.0-12.el6.x86_64.rpm.list:/var/log/bacula
bind-9.8.2-0.17.rc1.el6.x86_64.rpm.list:/var/log/named.log
bind-chroot-9.8.2-0.17.rc1.el6.x86_64.rpm.list:/var/named/chroot/var/log
cman-3.0.12.1-49.el6.x86_64.rpm.list:/var/log/cluster
conman-0.2.5-2.4.el6.x86_64.rpm.list:/var/log/conman
conman-0.2.5-2.4.el6.x86_64.rpm.list:/var/log/conman.old
ConsoleKit-0.4.1-3.el6.x86_64.rpm.list:/var/log/ConsoleKit
corosync-1.4.1-15.el6.x86_64.rpm.list:/var/log/cluster
cups-1.4.2-48.el6_3.3.x86_64.rpm.list:/var/log/cups
dracut-004-303.el6.noarch.rpm.list:/var/log/dracut.log
efax-0.9a-8.el6.x86_64.rpm.list:/var/log/fax
filesystem-2.4.30-3.el6.x86_64.rpm.list:/var/log
freeipmi-0.7.16-3.el6.i686.rpm.list:/var/log/ipmiconsole
freeipmi-0.7.16-3.el6.x86_64.rpm.list:/var/log/ipmiconsole
freeipmi-bmc-watchdog-0.7.16-3.el6.x86_64.rpm.list:/var/log/freeipmi
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radacct
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radius.log
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radutmp
gdm-2.30.4-39.el6.x86_64.rpm.list:/var/log/gdm
hplip-3.12.4-4.el6.x86_64.rpm.list:/var/log/hp
httpd-2.2.15-26.el6.x86_64.rpm.list:/var/log/httpd
initscripts-9.03.38-1.el6.x86_64.rpm.list:/var/log/btmp
initscripts-9.03.38-1.el6.x86_64.rpm.list:/var/log/wtmp
iptraf-3.0.1-14.el6.x86_64.rpm.list:/var/log/iptraf
isdn4k-utils-3.2-75.el6.i686.rpm.list:/var/log/vbox
isdn4k-utils-3.2-75.el6.x86_64.rpm.list:/var/log/vbox
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/lxc
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/qemu
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/uml
luci-0.26.0-37.el6.x86_64.rpm.list:/var/log/luci
luci-0.26.0-37.el6.x86_64.rpm.list:/var/log/luci/luci.log
mailman-2.1.12-18.el6.x86_64.rpm.list:/var/log/mailman
mysql-server-5.1.66-2.el6_3.x86_64.rpm.list:/var/log/mysqld.log
ntp-4.2.4p8-3.el6.x86_64.rpm.list:/var/log/ntpstats
pam-1.1.1-13.el6.i686.rpm.list:/var/log/tallylog
pam-1.1.1-13.el6.x86_64.rpm.list:/var/log/tallylog
piranha-0.8.6-2.el6.x86_64.rpm.list:/var/log/piranha
pm-utils-1.2.5-10.el6.x86_64.rpm.list:/var/log/pm-suspend.log
ppp-2.4.5-5.el6.x86_64.rpm.list:/var/log/ppp
prelink-0.4.6-3.el6.x86_64.rpm.list:/var/log/prelink
prelink-0.4.6-3.el6.x86_64.rpm.list:/var/log/prelink/prelink.log
quagga-0.99.15-7.el6_3.2.x86_64.rpm.list:/var/log/quagga
samba4-common-4.0.0-55.el6.rc4.x86_64.rpm.list:/var/log/samba
samba4-common-4.0.0-55.el6.rc4.x86_64.rpm.list:/var/log/samba/old
samba-common-3.6.9-151.el6.i686.rpm.list:/var/log/samba
samba-common-3.6.9-151.el6.i686.rpm.list:/var/log/samba/old
samba-common-3.6.9-151.el6.x86_64.rpm.list:/var/log/samba
samba-common-3.6.9-151.el6.x86_64.rpm.list:/var/log/samba/old
sendmail-8.14.4-8.el6.x86_64.rpm.list:/var/log/mail
sendmail-8.14.4-8.el6.x86_64.rpm.list:/var/log/mail/statistics
setroubleshoot-server-3.0.47-6.el6.x86_64.rpm.list:/var/log/setroubleshoot
setup-2.8.14-20.el6.noarch.rpm.list:/var/log/lastlog
squid-3.1.10-16.el6.x86_64.rpm.list:/var/log/squid
sssd-1.9.2-82.el6.x86_64.rpm.list:/var/log/sssd
subscription-manager-1.1.23-1.el6.x86_64.rpm.list:/var/log/rhsm
sysstat-9.0.4-20.el6.x86_64.rpm.list:/var/log/sa
systemtap-server-1.8-7.el6.x86_64.rpm.list:/var/log/stap-server
systemtap-server-1.8-7.el6.x86_64.rpm.list:/var/log/stap-server/log
tomcat6-6.0.24-49.el6.noarch.rpm.list:/var/log/tomcat6
tomcat6-6.0.24-49.el6.noarch.rpm.list:/var/log/tomcat6/catalina.out
tuned-0.2.19-11.el6.noarch.rpm.list:/var/log/tuned
util-linux-ng-2.17.2-12.9.el6.i686.rpm.list:/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.list:/var/log/lastlog
ConsoleKit-0.4.1-3.el6.x86_64.rpm.scripts:if [ -f
/var/log/ConsoleKit/history ]; then
ConsoleKit-0.4.1-3.el6.x86_64.rpm.scripts: chmod a+r
/var/log/ConsoleKit/history
gdm-2.30.4-39.el6.x86_64.rpm.scripts: -e 's@^LogDir=/var/log/gdm@#&@' \
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:touch /var/log/wtmp
/var/run/utmp /var/log/btmp
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chown root:utmp
/var/log/wtmp /var/run/utmp /var/log/btmp
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chmod 664 /var/log/wtmp
/var/run/utmp
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chmod 600 /var/log/btmp
mysql-server-5.1.66-2.el6_3.x86_64.rpm.scripts:/bin/touch
/var/log/mysqld.log
openwsman-server-2.2.3-8.el6.i686.rpm.scripts:rm -f /var/log/wsmand.log
openwsman-server-2.2.3-8.el6.x86_64.rpm.scripts:rm -f /var/log/wsmand.log
pam-1.1.1-13.el6.i686.rpm.scripts:if [ ! -e /var/log/tallylog ] ; then
pam-1.1.1-13.el6.i686.rpm.scripts: install -m 600 /dev/null
/var/log/tallylog
pam-1.1.1-13.el6.x86_64.rpm.scripts:if [ ! -e /var/log/tallylog ] ; then
pam-1.1.1-13.el6.x86_64.rpm.scripts: install -m 600 /dev/null
/var/log/tallylog
rsyslog-5.8.10-6.el6.x86_64.rpm.scripts:for n in
/var/log/{messages,secure,maillog,spooler}
selinux-policy-minimum-3.7.19-195.el6.noarch.rpm.scripts:restorecon -R
/root /var/log /var/run 2> /dev/null
selinux-policy-minimum-3.7.19-195.el6.noarch.rpm.scripts:
restorecon -R /root /var/log /var/run 2> /dev/null;
selinux-policy-mls-3.7.19-195.el6.noarch.rpm.scripts: restorecon -R
/root /var/log /var/run 2> /dev/null
selinux-policy-mls-3.7.19-195.el6.noarch.rpm.scripts: restorecon
- -R /root /var/log /var/run 2> /dev/null;
selinux-policy-targeted-3.7.19-195.el6.noarch.rpm.scripts:);
restorecon -R /root /var/log /var/run 2> /dev/null
selinux-policy-targeted-3.7.19-195.el6.noarch.rpm.scripts:
restorecon -R /root /var/log /var/run 2> /dev/null;
squid-3.1.10-16.el6.x86_64.rpm.scripts:for i in /var/log/squid
/var/spool/squid ; do
squid-3.1.10-16.el6.x86_64.rpm.scripts: rm -f /var/log/squid/*
sysstat-9.0.4-20.el6.x86_64.rpm.scripts: rm -f /var/log/sa/*
systemtap-server-1.8-7.el6.x86_64.rpm.scripts:test -e
/var/log/stap-server/log || {
systemtap-server-1.8-7.el6.x86_64.rpm.scripts: touch
/var/log/stap-server/log
systemtap-server-1.8-7.el6.x86_64.rpm.scripts: chmod 664
/var/log/stap-server/log
systemtap-server-1.8-7.el6.x86_64.rpm.scripts: chown
stap-server:stap-server /var/log/stap-server/log
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:# only for minimal
buildroots without /var/log
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:[ -d /var/log ] ||
/bin/mkdir -p /var/log
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/touch /var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/chown root:root
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/chmod 0644
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts: SECXT=$(
/usr/sbin/matchpathcon -n /var/log/lastlog 2> /dev/null )
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts: /usr/bin/chcon
"$SECXT" /var/log/lastlog >/dev/null 2>&1 || :
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:# only for minimal
buildroots without /var/log
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:[ -d /var/log ] ||
/bin/mkdir -p /var/log
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/touch
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/chown root:root
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/chmod 0644
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts: SECXT=$(
/usr/sbin/matchpathcon -n /var/log/lastlog 2> /dev/null )
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts: /usr/bin/chcon
"$SECXT" /var/log/lastlog >/dev/null 2>&1 || :
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQIcBAEBAgAGBQJSC9nxAAoJEBYNRVNeJnmTfv0P/3U65GKVzyKNQ0cyGgpAcfSm
qlv6kxKmz0opqQ7YSAx7Nq0dY7N7/5CvU7MlMOZ4uZrLtvEPJp0FJlfRuj0Kjc3h
rbCK3oJEcNOK9Ib/cptoi2q8ZXXb3dlHkq229dtxIFCGVfkqQPPdicp2I63dWl0t
voVLqSudlcr18YgW/nCLfCJoAphAM5SDp+P6xyqpVvhcvTShAqmDADS4rGs++Mnf
pS0kKT//R8Daw5RRlbc3snEILcdLuuHHAuEjM8fcgpX4G+8Z6X7dF7Y3m7Sk3iLt
v85uITiOfiC8uwmyRRK8/N41D6jRsy0MYy1aLUk6IlBGyCkmrqkNISgqebdn3Een
pdqyNP0PqrNdUpTWnmxaHpxONzMqHp3dRhOsuNgOP5t3qii+kQHHGFnPKw7B+uhW
URtpca1hcgkYl1jrcOvwN3W1BHaSXK64gDYVURd1DRXkdDJP+4mGChCBb9w4C2a8
WigiOOLp1EKOESScJsKDltYkL6SrSbWs9oipnkyWzuRs0RrvtBxmrqHrb/r66Dnl
jfkrq7H0OvZdvIg3X2rovyxLYM+iTI/yWQfOuvuXkmZqSvVYKh0L95Hf+ByQLQej
cqVo0UOh2kwJWNN5O5bvxGJVCLTa4WWwpA83mNZ65C5VddfqPyUm2a5Y7u4bKQ+2
xKqufw7kc91+ndu+c4wM
=5vTG
-----END PGP SIGNATURE-----