Audit migration

audit transplant
Reference resources https://blog.csdn.net/cfl927096306/article/details/101219403

yocto The following packages need to be installed , Compile the cross tool chain
IMAGE_INSTALL += " openldap libtool python3 swig"audit Source path  http://repository.timesys.com/buildsources/a/audit/
Decompression and typing patch

tar -xf audit-3.0.6.tar.gz
cd audit-3.0.6/

patch -p1 < ../audit-3.0.6-cross.patch
patch -p1 < ../audit-3.0.6-sys_stat_h.patch

source /opt/origin/environment-setup-cortexa53-crypto-poky-linux

./configure --host=arm-none-linux --with-arm=yes --prefix=/XXX/tools/audit/audit-3.0.6/audit-3.0.6/__install

Report errors
/usr/include/python3.8/pyconfig.h:9:12: fatal error: aarch64-linux-gnu/python3.8/pyconfig.h: No such file or directory
    9 | #  include <aarch64-linux-gnu/python3.8/pyconfig.h>
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
modify ：

sed -i "s/\/usr\/include\/python3.8/\/opt\/origin\/sysroots\/cortexa53-crypto-poky-linux\/usr\/include\/python3.9/g" `grep /usr/include/python3.8 -rl ./`

Replacement means
sed -i "s/ Original string / New string /g" `grep Original string -rl In the directory `

make -j32
make install

-------------------------

cp -rfp sbin/* /sbin/
cp -rfp bin/* /bin/
cp -rfp lib/ /lib/
cp -rfp lib/* /lib/
cp -rfp etc/* /etc/
mkdir -p /var/log/audit
chown root /etc/audit/auditd.conf
chown root /sbin/audispd

-----------------------------------------

mkdir -p /var/log/audit
auditd -f


auditctl -a exit,always -F arch=b64 -S kill -F a1=9


auditctl -a exit,always -F arch=b64 -S kill -k my_monitor_kill