From 27b0ca074f8c80822b5a61d9fe4b5c7f20e5fdf9 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Thu, 18 Jun 2020 13:40:29 -0400 Subject: [PATCH] Add librpm.so.9 to the names dlopen searches (#19275) Fedora 31 and 32 use librpm.so.9, but Auditbeat's system/package dataset doesn't try to load this version of the library. Fixes #19253 (cherry picked from commit 6fedaef96ea8619b3b2f771f3752b791b2528962) --- CHANGELOG.next.asciidoc | 1 + x-pack/auditbeat/module/system/package/rpm_linux.go | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 05bc218a4e8a..1697c85d9ac0 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -157,6 +157,7 @@ field. You can revert this change by configuring tags for the module and omittin - system/package: Fix an error that can occur while trying to persist package metadata. {issue}18536[18536] {pull}18887[18887] - system/socket: Fix dataset using 100% CPU and becoming unresponsive in some scenarios. {pull}19033[19033] - system/socket: Fixed tracking of long-running connections. {pull}19033[19033] +- system/package: Fix librpm loading on Fedora 31/32. {pull}NNNN[NNNN] *Filebeat* diff --git a/x-pack/auditbeat/module/system/package/rpm_linux.go b/x-pack/auditbeat/module/system/package/rpm_linux.go index e3a1e6f78c51..fa6fc66f4cdc 100644 --- a/x-pack/auditbeat/module/system/package/rpm_linux.go +++ b/x-pack/auditbeat/module/system/package/rpm_linux.go @@ -207,11 +207,13 @@ func (lib *librpm) close() error { func openLibrpm() (*librpm, error) { var librpmNames = []string{ "librpm.so", // with rpm-devel installed - "librpm.so.8", // Fedora 29 + "librpm.so.9", // Fedora 31/32 + "librpm.so.8", // Fedora 29/30 "librpm.so.3", // CentOS 7 "librpm.so.1", // CentOS 6 // Following for completeness, but not explicitly tested + "librpm.so.10", "librpm.so.7", "librpm.so.6", "librpm.so.5",