Arch Linux User Repository

This package provides some improvements over the original e4rat package, and circumvents some usability issues. To use the tools included with the package, follow the instructions upstream: https://github.com/ShyPixie/e4rat-lite#how-to-use Note that in order to use the audit tools, a kernel build with auditing support enabled is required.

@cubethethird, it turns out that I indeed have /bin in my $PATH. Thanks

@heraldofsolace, I am unable to reproduce this issue, as it appears to be the result of non-standard configurations on your end. Sources tell me this is a bug with cmake that only occurs if you explicitly add /bin to your PATH (which you shouldn't do).

Getting some error with boost.

-- The C compiler identification is GNU 10.1.0
-- The CXX compiler identification is GNU 10.1.0
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /bin/cc - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Check for working CXX compiler: /bin/c++ - skipped
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Found Boost: /lib64/cmake/Boost-1.72.0/BoostConfig.cmake (found suitable version "1.72.0", minimum required is "1.41") found components: system filesystem regex
-- Found ext2fs: /usr/lib/libext2fs.so
-- Found audit: /usr/lib/libaudit.so
-- Found auparse: /usr/lib/libauparse.so
-- Looking for pthread.h
-- Looking for pthread.h - found
-- Performing Test CMAKE_HAVE_LIBC_PTHREAD
-- Performing Test CMAKE_HAVE_LIBC_PTHREAD - Failed
-- Looking for pthread_create in pthreads
-- Looking for pthread_create in pthreads - not found
-- Looking for pthread_create in pthread
-- Looking for pthread_create in pthread - found
-- Found Threads: TRUE
-- Found Gettext: /bin/msgmerge (found version "0.20.2")
-- Configuring done
CMake Error in src/CMakeLists.txt:
  Imported target "Boost::system" includes non-existent path

    "/include"

  in its INTERFACE_INCLUDE_DIRECTORIES.  Possible reasons include:

  * The path was deleted, renamed, or moved to another location.

  * An install or uninstall procedure did not complete successfully.

  * The installation package was faulty and references files it does not
   provide.



 CMake Error in src/CMakeLists.txt:
   Imported target "Boost::system" includes non-existent path

     "/include"

  in its INTERFACE_INCLUDE_DIRECTORIES.  Possible reasons include:

  * The path was deleted, renamed, or moved to another location.

  * An install or uninstall procedure did not complete successfully.

  * The installation package was faulty and references files it does not
   provide.



 CMake Error in src/CMakeLists.txt:
   Imported target "Boost::system" includes non-existent path

    "/include"

   in its INTERFACE_INCLUDE_DIRECTORIES.  Possible reasons include:

   * The path was deleted, renamed, or moved to another location.

   * An install or uninstall procedure did not complete successfully.

   * The installation package was faulty and references files it does not
   provide.



 CMake Error in src/CMakeLists.txt:
   Imported target "Boost::system" includes non-existent path

     "/include"

   in its INTERFACE_INCLUDE_DIRECTORIES.  Possible reasons include:

   * The path was deleted, renamed, or moved to another location.

   * An install or uninstall procedure did not complete successfully.

   * The installation package was faulty and references files it does not
   provide.



 -- Generating done
 CMake Generate step failed.  Build files cannot be regenerated correctly.

Here's a working patch:

diff --git CMakeLists.txt CMakeLists.txt
index 10969c2..dd28028 100644
--- e4rat-lite/CMakeLists.txt
+++ e4rat-lite/CMakeLists.txt
@@ -20,7 +20,7 @@ IF(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
 ENDIF(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)

 set(Boost_USE_STATIC_LIBS   OFF)
-set(Boost_USE_MULTITHREADED OFF)
+set(Boost_USE_MULTITHREADED ON)
 find_package(Boost 1.41 COMPONENTS system filesystem regex REQUIRED)
 set(${PROJECT_NAME}_LIBRARIES   ${${PROJECT_NAME}_LIBRARIES}
     ${Boost_LIBRARIES})

Add this at the end of prepare() function in PKGBUILD:

patch -p1 < ../cmake_boost.patch

There seems to be some error with latest boost:

==> Starting build()...
-- The C compiler identification is GNU 9.2.0
-- The CXX compiler identification is GNU 9.2.0
-- Check for working C compiler: /usr/bin/cc
-- Check for working C compiler: /usr/bin/cc -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: /usr/bin/c++
-- Check for working CXX compiler: /usr/bin/c++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
CMake Error at /usr/lib64/cmake/Boost-1.72.0/BoostConfig.cmake:120 (find_package):
  Found package configuration file:

    /usr/lib64/cmake/boost_system-1.72.0/boost_system-config.cmake

  but it set boost_system_FOUND to FALSE so package "boost_system" is
  considered to be NOT FOUND.  Reason given by package:

  No suitable build variant has been found.

  The following variants have been tried and rejected:

  * libboost_system.so.1.72.0 (multithreaded, Boost_USE_MULTITHREADED=OFF)

  * libboost_system.a (static, Boost_USE_STATIC_LIBS=OFF)

Call Stack (most recent call first):
  /usr/lib64/cmake/Boost-1.72.0/BoostConfig.cmake:185 (boost_find_component)
  /usr/share/cmake-3.16/Modules/FindBoost.cmake:443 (find_package)
  CMakeLists.txt:24 (find_package)


CMake Warning (dev) in /usr/share/cmake-3.16/Modules/FindBoost.cmake:
  Policy CMP0011 is not set: Included scripts do automatic cmake_policy PUSH
  and POP.  Run "cmake --help-policy CMP0011" for policy details.  Use the
  cmake_policy command to set the policy and suppress this warning.

  The included script

    /usr/share/cmake-3.16/Modules/FindBoost.cmake

  affects policy settings.  CMake is implying the NO_POLICY_SCOPE option for
  compatibility, so the effects are applied to the including context.
Call Stack (most recent call first):
  CMakeLists.txt:24 (find_package)
This warning is for project developers.  Use -Wno-dev to suppress it.

-- Configuring incomplete, errors occurred!
See also "/home/farzeen/.cache/yay/e4rat-lite-git/src/build/CMakeFiles/CMakeOutput.log".
==> ERROR: A failure occurred in build().
    Aborting...
Error making: e4rat-lite-git

@johnywhy, rebuilding audit is not required for this package. Also, now that auditing support is natively enabled on the base kernel, you don't need to build that either.

This article says "you must first rebuild audit", to use the original e4rat. https://wiki.archlinux.org/index.php/E4rat

Is the same true of e4rat-lite?

thx

Here's a working patch:

diff -Naur -b '--to-file=e4rat-lite-patched/src/' -x '*.o' -x '*.tu' e4rat-lite/src/device.cc e4rat-lite-patched/src/device.cc
--- e4rat-lite/src/device.cc    2018-09-20 19:40:39.823493172 +0530
+++ e4rat-lite-patched/src/device.cc    2018-09-20 19:54:10.323375842 +0530
@@ -32,6 +32,8 @@

 #include <boost/lexical_cast.hpp>

+#include <sys/sysmacros.h>
+
 #define BLOCKS_PER_GROUP(fs)      (fs->super->s_blocks_per_group)
 #define BLOCKS_PER_FLEX(fs)       (BLOCKS_PER_GROUP(fs) << fs->super->s_log_groups_per_flex)
 #define FREE_BLOCKS_PER_GROUP(fs) ( BLOCKS_PER_GROUP(fs)        \

diff -Naur -b '--to-file=e4rat-lite-patched/src/' -x '*.o' -x '*.tu' e4rat-lite/src/e4rat-collect.cc e4rat-lite-patched/src/e4rat-collect.cc
--- e4rat-lite/src/e4rat-collect.cc 2018-09-20 19:40:39.823493172 +0530
+++ e4rat-lite-patched/src/e4rat-collect.cc 2018-09-20 19:59:25.503867639 +0530
@@ -48,6 +48,8 @@

 #include <boost/foreach.hpp>

+#include <sys/sysmacros.h>
+
 #define PID_FILE "/dev/.e4rat-lite-collect.pid"
 #define MATCH(s, n) strcmp(section, s) == 0 && strcmp(name, n) == 0

diff -Naur -b '--to-file=e4rat-lite-patched/src/' -x '*.o' -x '*.tu' e4rat-lite/src/listener.cc e4rat-lite-patched/src/listener.cc
--- e4rat-lite/src/listener.cc  2018-09-20 19:40:39.826826547 +0530
+++ e4rat-lite-patched/src/listener.cc  2018-09-20 20:04:09.833981860 +0530
@@ -43,6 +43,8 @@

 #include <fstream>

+#include <sys/sysmacros.h>
+
 std::string getProcessName(pid_t pid)
 {
     std::string comm;

Add this at the end of prepare() function in PKGBUILD:

    cd "$srcdir"/$_gitname
    patch -p1 < ../sysmacros_h.patch

Build fails with the following error:

Scanning dependencies of target e4rat-lite-core  
[  5%] Building C object src/CMakeFiles/e4rat-lite-core.dir/config.c.o  
[ 11%] Building CXX object src/CMakeFiles/e4rat-lite-core.dir  /logging.cc.o  
[ 16%] Building CXX object src/CMakeFiles/e4rat-lite-core.dir/common.cc.o  
[ 22%] Building CXX object src/CMakeFiles/e4rat-lite-core.dir/fiemap.cc.o  
[ 27%] Building CXX object src/CMakeFiles/e4rat-lite-core.dir/device.cc.o  
/tmp/yaourt-tmp-farzeen/aur-e4rat-lite-git/src/e4rat-lite/src/device.cc: In member function ‘int Device::getDevNameFromMajorMinor()’:    
/tmp/yaourt-tmp-farzeen/aur-e4rat-lite-git/src/e4rat-lite/src/device.cc:219:35: error: ‘major’ cannot be used as a function  
     int major = major(get()->devno);  
                                   ^  
/tmp/yaourt-tmp-farzeen/aur-e4rat-lite-git/src/e4rat-lite/src/device.cc:220:35: error: ‘minor’ cannot be used as a function  
     int minor = minor(get()->devno);  
                                   ^  
make[2]: *** [src/CMakeFiles/e4rat-lite-core.dir/build.make:115: src/CMakeFiles/e4rat-lite-core.dir/device.cc.o] Error 1  
make[1]: *** [CMakeFiles/Makefile2:166: src/CMakeFiles/e4rat-lite-core.dir/all] Error 2  
make: *** [Makefile:130: all] Error 2  

An older build log found by googling gave warnings about the definition of major and minor being moved into <sys/sysmacros.h> in future versions of GNU C library. http://people.slitaz.org/~az_ua/m/log-next/e4rat.log

Unfortunately I can't add linux-zen as a dependency, as that would require all users to install it. Instead, I removed the existing linux dependency. I'm surprised the linux-zen package does not provide linux, as many of the other kernel packages do. Considering the required linux kernel version is fairly old at this point, I don't expect it will cause any issues to remove this requirement. I don't know if linux-zen is built with auditing support, but if not, you will need to use (or build) a kernel with it enabled to use the e4rat-lite-collect procedure with success. Once that is done the auditing is not required.