Skip to content
GitLab

Add support for reading s390x and aarch64 wtmp file

Merged Christian Boltz requested to merge cboltz/apparmor:cboltz-aa-notify-multiarch into master

Both aarch64 and s390x have a bigger wtmp record size (16 bytes more than x86_64, 400 bytes total).

The byte position of the timestamp is also different on each architecture. To make things even more interesting, s390x is big endian.

Note that this MR includes more things, like

  • moving get_last_login_timestamp() to the new apparmor/notify.py file
  • add unit tests for it
  • add wtmp example files from various architectures, including a hand-edited one claiming to be from 1999
  • fixing a bug in get_last_login_timestamp() that unpacked type from too many bytes - which accidently worked on x86_64
  • detecting from which architecture the wtmp file comes (luckily the timestamps are located at different locations)

See the individual commits for details.

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1181155

I propose this patch for 3.0 and master.

(2.13 and older have the old perl-based aa-notify, which makes backporting this patch a bit ;-) harder.)

Edited by Christian Boltz