Skip to content

Fix AIDE Database option deprecation #14557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Azim-Azizov wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix AIDE Database option deprecation #14557

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f9fc64e
Fix AIDE Database option deprecation
Azim-Azizov Mar 12, 2026
ef93300
Add support for pre-0.17 database option and support post-0.17 in all…
Azim-Azizov Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions .../system/software/integrity/software-integrity/aide/aide_build_database/ansible/debian.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,14 @@
name: aide
state: present

- name: "{{{ rule_title }}} - Check if DB Path in /etc/aide/aide.conf Is Already Set"
- name: "{{{ rule_title }}} - Check if DB In Path in /etc/aide/aide.conf Is Already Set"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
regexp: ^#?(\s*)(database=)(.*)$
regexp: ^#?(\s*)({{ aide_db_in_key }}=)(.*)$
state: absent
check_mode: true
changed_when: false
register: database_replace
register: database_in_replace

- name: "{{{ rule_title }}} - Check if DB Out Path in /etc/aide/aide.conf Is Already Set"
ansible.builtin.lineinfile:
Expand All @@ -27,13 +27,13 @@
changed_when: false
register: database_out_replace

- name: "{{{ rule_title }}} - Fix DB Path in Config File if Necessary"
- name: "{{{ rule_title }}} - Fix DB In Path in Config File if Necessary"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
regexp: ^#?(\s*)(database)(\s*)=(\s*)(.*)$
regexp: ^#?(\s*)({{ aide_db_in_key }})(\s*)=(\s*)(.*)$
line: \2\3=\4file:/var/lib/aide/aide.db
backrefs: true
when: database_replace.found > 0
when: database_in_replace.found > 0

- name: "{{{ rule_title }}} - Fix DB Out Path in Config File if Necessary"
ansible.builtin.lineinfile:
Expand All @@ -43,14 +43,14 @@
backrefs: true
when: database_out_replace.found > 0

- name: "{{{ rule_title }}} - Ensure the Default DB Path is Added"
- name: "{{{ rule_title }}} - Ensure the Default DB In Path is Added"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
line: database=file:/var/lib/aide/aide.db
line: "{{ aide_db_in_key }}=file:/var/lib/aide/aide.db"
create: true
when: database_replace.found == 0
when: database_in_replace.found == 0

- name: "{{{ rule_title }}} - Ensure the Default Out Path is Added"
- name: "{{{ rule_title }}} - Ensure the Default DB Out Path is Added"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
line: database_out=file:/var/lib/aide/aide.db.new
Expand Down
9 changes: 9 additions & 0 deletions .../system/software/integrity/software-integrity/aide/aide_build_database/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,15 @@
with_items:
- aide

- name: "{{{ rule_title }}} - Gather AIDE Package Facts"
ansible.builtin.package_facts:
manager: auto
filter: aide

- name: "{{{ rule_title }}} - Set AIDE DB Key"
ansible.builtin.set_fact:
aide_db_in_key: "{{ 'database_in' if (ansible_facts.packages['aide'][0].version is version('0.17', '>=')) else 'database' }}"

- name: "{{{ rule_title }}} - Check Whether the Stock AIDE Database Exists"
ansible.builtin.stat:
path: {{{ aide_stage_src }}}
Expand Down
20 changes: 10 additions & 10 deletions .../system/software/integrity/software-integrity/aide/aide_build_database/ansible/ubuntu.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,14 @@
name: aide
state: present

- name: "{{{ rule_title }}} - Check if DB Path in /etc/aide/aide.conf Is Already Set"
- name: "{{{ rule_title }}} - Check if DB In Path in /etc/aide/aide.conf Is Already Set"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
regexp: ^#?(\s*)(database=)(.*)$
regexp: ^#?(\s*)({{ aide_db_in_key }}=)(.*)$
state: absent
check_mode: true
changed_when: false
register: database_replace
register: database_in_replace

- name: "{{{ rule_title }}} - Check if DB Out Path in /etc/aide/aide.conf Is Already Set"
ansible.builtin.lineinfile:
Expand All @@ -27,13 +27,13 @@
changed_when: false
register: database_out_replace

- name: "{{{ rule_title }}} - Fix DB Path in Config File if Necessary"
- name: "{{{ rule_title }}} - Fix DB In Path in Config File if Necessary"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
regexp: ^#?(\s*)(database)(\s*)=(\s*)(.*)$
regexp: ^#?(\s*)({{ aide_db_in_key }})(\s*)=(\s*)(.*)$
line: \2\3=\4file:/var/lib/aide/aide.db
backrefs: true
when: database_replace.found > 0
when: database_in_replace.found > 0

- name: "{{{ rule_title }}} - Fix DB Out Path in Config File if Necessary"
ansible.builtin.lineinfile:
Expand All @@ -43,14 +43,14 @@
backrefs: true
when: database_out_replace.found > 0

- name: "{{{ rule_title }}} - Ensure the Default DB Path is Added"
- name: "{{{ rule_title }}} - Ensure the Default DB In Path is Added"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
line: database=file:/var/lib/aide/aide.db
line: "{{ aide_db_in_key }}=file:/var/lib/aide/aide.db"
create: true
when: database_replace.found == 0
when: database_in_replace.found == 0

- name: "{{{ rule_title }}} - Ensure the Default Out Path is Added"
- name: "{{{ rule_title }}} - Ensure the Default DB Out Path is Added"
ansible.builtin.lineinfile:
path: /etc/aide/aide.conf
line: database_out=file:/var/lib/aide/aide.db.new
Expand Down
16 changes: 8 additions & 8 deletions ...uide/system/software/integrity/software-integrity/aide/aide_build_database/bash/debian.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,21 +2,21 @@

{{{ bash_package_install("aide") }}}

AIDE_VERSION=$(aide -v | grep -oP 'aide \K[0-9]+\.[0-9]+')
if [ "$(echo "$AIDE_VERSION >= 0.17" | bc -l)" -eq 1 ]; then
AIDE_DB__KEY="database_in"
Copy link
Contributor

@dodys dodys Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should it be AIDE_DB_IN_KEY?

else
AIDE_DB_IN_KEY="database"
fi
AIDE_CONFIG=/etc/aide/aide.conf
DEFAULT_DB_PATH=/var/lib/aide/aide.db

# Fix db path in the config file, if necessary
{{% if product == 'debian13' %}}
if ! grep -q '^database_in=file:' ${AIDE_CONFIG}; then
echo "database_in=file:${DEFAULT_DB_PATH}" >> ${AIDE_CONFIG}
fi
{{% else %}}
if ! grep -q '^database=file:' ${AIDE_CONFIG}; then
if ! grep -q "^${AIDE_DB_IN_KEY}=file:" ${AIDE_CONFIG}; then
# replace_or_append gets confused by 'database=file' as a key, so should not be used.
#replace_or_append "${AIDE_CONFIG}" '^database=file' "${DEFAULT_DB_PATH}" '@CCENUM@' '%s:%s'
echo "database=file:${DEFAULT_DB_PATH}" >> ${AIDE_CONFIG}
echo "${AIDE_DB_IN_KEY}=file:${DEFAULT_DB_PATH}" >> ${AIDE_CONFIG}
fi
{{% endif %}}

# Fix db out path in the config file, if necessary
if ! grep -q '^database_out=file:' ${AIDE_CONFIG}; then
Expand Down
10 changes: 8 additions & 2 deletions ...uide/system/software/integrity/software-integrity/aide/aide_build_database/bash/ubuntu.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,20 @@

{{{ bash_package_install("aide") }}}

AIDE_VERSION=$(aide -v | grep -oP 'aide \K[0-9]+\.[0-9]+')
if [ "$(echo "$AIDE_VERSION >= 0.17" | bc -l)" -eq 1 ]; then
AIDE_DB__KEY="database_in"
Copy link
Contributor

@dodys dodys Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should it be AIDE_DB_IN_KEY?

else
AIDE_DB_IN_KEY="database"
fi
AIDE_CONFIG=/etc/aide/aide.conf
DEFAULT_DB_PATH=/var/lib/aide/aide.db

# Fix db path in the config file, if necessary
if ! grep -q '^database=file:' ${AIDE_CONFIG}; then
if ! grep -q "^${AIDE_DB_IN_KEY}=file:" ${AIDE_CONFIG}; then
# replace_or_append gets confused by 'database=file' as a key, so should not be used.
#replace_or_append "${AIDE_CONFIG}" '^database=file' "${DEFAULT_DB_PATH}" '@CCENUM@' '%s:%s'
echo "database=file:${DEFAULT_DB_PATH}" >> ${AIDE_CONFIG}
echo "${AIDE_DB_IN_KEY}=file:${DEFAULT_DB_PATH}" >> ${AIDE_CONFIG}
fi

# Fix db out path in the config file, if necessary
Expand Down
6 changes: 1 addition & 5 deletions ...ide/system/software/integrity/software-integrity/aide/aide_build_database/oval/debian.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,11 +39,7 @@
<!-- OVAL object to collect filename for Aide build database -->
<ind:textfilecontent54_object id="object_aide_operational_database_filepath" version="1">
<ind:filepath>/etc/aide/aide.conf</ind:filepath>
{{% if product == "debian13" %}}
<ind:pattern operation="pattern match">^database_in=file:(?:@@{DBDIR}/)?([a-z./]+)$</ind:pattern>
{{% else %}}
<ind:pattern operation="pattern match">^database=file:(?:@@{DBDIR}/)?([a-z./]+)$</ind:pattern>
{{% endif %}}
<ind:pattern operation="pattern match">^database(?:_in)?=file:(?:@@{DBDIR}/)?([a-z./]+)$</ind:pattern>
<!-- From aide.conf(5) - "If there are multiple database lines, then the first one is used" =>
therefore we will retrieve only the first instance -->
<ind:instance operation="equals" datatype="int">1</ind:instance>
Expand Down
2 changes: 1 addition & 1 deletion ...ide/system/software/integrity/software-integrity/aide/aide_build_database/oval/ubuntu.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
<!-- OVAL object to collect filename for Aide build database -->
<ind:textfilecontent54_object id="object_aide_operational_database_filepath" version="1">
<ind:filepath>/etc/aide/aide.conf</ind:filepath>
<ind:pattern operation="pattern match">^database=file:(?:@@{DBDIR}/)?([a-z./]+)$</ind:pattern>
<ind:pattern operation="pattern match">^database(?:_in)?=file:(?:@@{DBDIR}/)?([a-z./]+)$</ind:pattern>
<!-- From aide.conf(5) - "If there are multiple database lines, then the first one is used" =>
therefore we will retrieve only the first instance -->
<ind:instance operation="equals" datatype="int">1</ind:instance>
Expand Down
12 changes: 7 additions & 5 deletions .../integrity/software-integrity/aide/aide_build_database/tests/get_db_path_absolute.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,10 @@ DB_CONF=/etc/aide.conf

cp "$DB_PATH/$DB_NAME_NEW" "$DB_PATH/$DB_NAME"

{{% if product in [ 'ol10', 'rhel10', 'fedora' ] %}}
sed -i "s#^database_in=file:.*#database_in=file:$DB_PATH/$DB_NAME#" $DB_CONF
{{% else %}}
sed -i "s#^database=file:.*#database=file:$DB_PATH/$DB_NAME#" $DB_CONF
{{% endif %}}
AIDE_VERSION=$(aide -v | grep -oP 'aide \K[0-9]+\.[0-9]+')
if [ "$(echo "$AIDE_VERSION >= 0.17" | bc -l)" -eq 1 ]; then
AIDE_DB__KEY="database_in"
Copy link
Contributor

@dodys dodys Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should it be AIDE_DB_IN_KEY?

else
AIDE_DB_IN_KEY="database"
fi
sed -i "s#^$AIDE_DB_IN_KEY}=file:.*#${AIDE_DB_IN_KEY}=file:$DB_PATH/$DB_NAME#" $DB_CONF
13 changes: 8 additions & 5 deletions ...are/integrity/software-integrity/aide/aide_build_database/tests/get_db_path_dbdir.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,11 @@ DB_CONF=/etc/aide.conf

cp "$DB_PATH/$DB_NAME_NEW" "$DB_PATH/$DB_NAME"

{{% if product in [ 'ol10', 'rhel10', 'fedora' ] %}}
sed -i "s#^database_in=file:.*#database_in=file:@@{DBDIR}/$DB_NAME#" $DB_CONF
{{% else %}}
sed -i "s#^database=file:.*#database=file:@@{DBDIR}/$DB_NAME#" $DB_CONF
{{% endif %}}

AIDE_VERSION=$(aide -v | grep -oP 'aide \K[0-9]+\.[0-9]+')
if [ "$(echo "$AIDE_VERSION >= 0.17" | bc -l)" -eq 1 ]; then
AIDE_DB__KEY="database_in"
Copy link
Contributor

@dodys dodys Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should it be AIDE_DB_IN_KEY?

Copy link
Author

@Azim-Azizov Azim-Azizov Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it should be. AI autocompletion messed up. Will do a fix commit.

else
AIDE_DB_IN_KEY="database"
fi
sed -i "s#^${AIDE_DB_IN_KEY}=file:.*#${AIDE_DB_IN_KEY}=file:@@{DBDIR}/$DB_NAME#" $DB_CONF
Loading