Add librpm.so.9 to the names dlopen searches

[andrewkroh]

What does this PR do?

Fedora 31 and 32 use librpm.so.9, but Auditbeat's system/package dataset doesn't try to load
this version of the library.

Why is it important?

It makes the system/package dataset work on newer Fedora releases.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Fixes [Auditbeat] system/package failing on Fedora 31+ #19253

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #19275 opened]

• Start Time: 2020-06-18T14:49:25.540+0000

• Duration: 40 min 44 sec

Test stats 🧪

Test	Results
Failed	0
Passed	766
Skipped	176
Total	942

[leehinman]

Long term I'm wondering if we should take advantage of ldconfig, something along the lines of

ldconfig -p | grep "librpm\.so"

[andrewkroh]

Yes, I totally agree a solution like that is the optimal path. I'm just not sure what the right way to make that work is. In general search the library paths for librpm and prefer the newest (or newest that Auditbeat is compatible with).

ldconfig -p | grep -i rpm didn't actually find librpm for me on Fedora 31 (from beats vagrantfile).

[leehinman]

Yes, I totally agree a solution like that is the optimal path. I'm just not sure what the right way to make that work is. In general search the library paths for librpm and prefer the newest (or newest that Auditbeat is compatible with).

ldconfig -p | grep -i rpm didn't actually find librpm for me on Fedora 31 (from beats vagrantfile).

We should probably open a new Issue for tracking the improvement. I'm totally fine with the current fix.

That's weird, I was testing on Fedora31 from beats vagrant file too and got:

[vagrant@localhost ~]$ ldconfig -p | grep "librpm\.so"
	librpm.so.9 (libc6,x86-64) => /lib64/librpm.so.9
	librpm.so (libc6,x86-64) => /lib64/librpm.so
[vagrant@localhost ~]$

I wonder what is different? Suggests this isn't robust enough. Maybe

rpm -ql rpm-libs | grep "librpm\.so"

is more reliable.

[andrewkroh]

I had two windows open testing auditbeat related stuff and I must have got them confused. It works for too when I use the right OS 🤦 .

[andrewkroh]

@leehinman Issue created: #19287