audit 移植

audit移植
参考https://blog.csdn.net/cfl927096306/article/details/101219403

yocto需要安装以下包，编译出交叉工具链
IMAGE_INSTALL += " openldap libtool python3 swig"audit 源码路径  http://repository.timesys.com/buildsources/a/audit/
解压打patch

tar -xf audit-3.0.6.tar.gz
cd audit-3.0.6/

patch -p1 < ../audit-3.0.6-cross.patch
patch -p1 < ../audit-3.0.6-sys_stat_h.patch

source /opt/origin/environment-setup-cortexa53-crypto-poky-linux

./configure --host=arm-none-linux --with-arm=yes --prefix=/XXX/tools/audit/audit-3.0.6/audit-3.0.6/__install

报错
/usr/include/python3.8/pyconfig.h:9:12: fatal error: aarch64-linux-gnu/python3.8/pyconfig.h: No such file or directory
    9 | #  include <aarch64-linux-gnu/python3.8/pyconfig.h>
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
修改：

sed -i "s/\/usr\/include\/python3.8/\/opt\/origin\/sysroots\/cortexa53-crypto-poky-linux\/usr\/include\/python3.9/g" `grep /usr/include/python3.8 -rl ./`

替换的意思
sed -i "s/原字符串/新字符串/g" `grep 原字符串 -rl 所在目录`

make -j32
make install

-------------------------

cp -rfp sbin/* /sbin/
cp -rfp bin/* /bin/
cp -rfp lib/ /lib/
cp -rfp lib/* /lib/
cp -rfp etc/* /etc/
mkdir -p /var/log/audit
chown root /etc/audit/auditd.conf
chown root /sbin/audispd

-----------------------------------------

mkdir -p /var/log/audit
auditd -f


auditctl -a exit,always -F arch=b64 -S kill -F a1=9


auditctl -a exit,always -F arch=b64 -S kill -k my_monitor_kill