一、下载bash源码包
[root@repo other_x86_64]# http://vault.centos.org/6.9/os/Source/SPackages/bash-4.1.2-48.el6.src.rpm
二、安装源码包
[root@repo other_x86_64]# rpm -ivh bash-4.1.2-48.el6.src.rpm #警告可以忽略1:bash warning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using root########################################### [100%]warning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using rootwarning: user mockbuild does not exist - using rootwarning: group mockbuild does not exist - using roo
[root@repo ~]# lltotal 7208056-rw-------. 1 root root 1891 Jul 7 2016 anaconda-ks.cfg-rw-r--r-- 1 root root 6686039 Jul 11 2016 bash-4.1.2-40.el6.src.rpm-rw-r--r--. 1 root root 41443 Jul 7 2016 install.log-rw-r--r--. 1 root root 7572 Jul 7 2016 install.log.syslogdrwxr-xr-x 8 root root 4096 Jul 11 2016 rpmbuild[root@repo ~]# cd rpmbuild/[root@repo rpmbuild]# lltotal 24drwxr-xr-x 3 root root 4096 Jul 11 2016 BUILDdrwxr-xr-x 2 root root 4096 Jul 11 2016 BUILDROOTdrwxr-xr-x 3 root root 4096 Jul 11 2016 RPMSdrwxr-xr-x 4 root root 4096 Jul 25 10:47 SOURCESdrwxr-xr-x 2 root root 4096 Jul 25 10:47 SPECSdrwxr-xr-x 2 root root 4096 Jul 11 2016 SRPMS
三、重新编译
[root@repo rpmbuild]# cd SOURCES/[root@repo SOURCES]# tar xf bash-4.1.tar.gz[root@repo SOURCES]# cp -a bash-4.1 bash-4.1-orig[root@repo SOURCES]# cd bash-4.1[root@repo bash-4.1]# vim config-top.h +104/* #define SYSLOG_HISTORY */#if defined (SYSLOG_HISTORY)# define SYSLOG_FACILITY LOG_USER# define SYSLOG_LEVEL LOG_INFO#endif
修改为
#define SYSLOG_HISTORY#if defined (SYSLOG_HISTORY)# define SYSLOG_FACILITY LOG_LOCAL1# define SYSLOG_LEVEL LOG_DEBUG#endif
[root@repo bash-4.1]# vim bashhist.c +701voidbash_syslog_history (line)const char *line;{char trunc[SYSLOG_MAXLEN];if (strlen(line) < SYSLOG_MAXLEN)syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d UID=%d %s", getpid(), current_user.uid, line);else{strncpy (trunc, line, SYSLOG_MAXLEN);trunc[SYSLOG_MAXLEN - 1] = '\0';syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d UID=%d %s", getpid(), current_user.uid, trunc);}} 修改为
voidbash_syslog_history (line)const char *line;{char trunc[SYSLOG_MAXLEN];if (strlen(line) < SYSLOG_MAXLEN) syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PPID=%d PID=%d SID=%d UID=%d User=%s %s", getppid(),getpid(),getsid(getpid()),current_user.uid, current_user.user_name,line);else{strncpy (trunc, line, SYSLOG_MAXLEN);trunc[SYSLOG_MAXLEN - 1] = '\0';syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PPID=%d PID=%d SID=%d UID=%d User=%s %s", getppid(),getpid(),getsid(getpid()),current_user.uid,current_user.user_name,trunc);}}#endif [root@repo bash-4.1]# cd ..[root@repo SOURCES]# diff -Npru bash-4.1-orig bash-4.1 > bash_history_syslog.patch[root@repo SOURCES]# lsbash-2.02-security.patch bash-4.1-bind_int_variable.patch bash-4.1-orig bash-4.3-fix-terminate_immediately.patchbash-2.03-paths.patch bash-4.1-brace-expansion.patch bash-4.1-posix-block-size-for-cf-options.patch bash-4.3-read-sigterm.patchbash-2.03-profile.patch bash-4.1-broken_pipe.patch bash-4.1-sighup-deadlock.patch bash-4.4-param-expansion.patchbash-2.05a-interpreter.patch bash-4.1-defer-sigchld-trap.patch bash-4.1-signal.patch bash-bashbug.patchbash-2.05b-debuginfo.patch bash-4.1-enable-hyphened-fn-export.patch bash-4.1-signal-sarestart.patch bash-cve-2016-9401.patchbash-2.05b-manso.patch bash-4.1-env-inject.patch bash-4.1.tar.gz bash_history_syslog.patchbash-2.05b-pgrp_sync.patch bash-4.1-examples.patch bash-4.1-trap.patch bash-infotags.patchbash-2.05b-readline-oom.patch bash-4.1-extglob-man.patch bash-4.2-1207042-double-alloc.patch bash-requires.patchbash-2.05b-xcc.patch bash-4.1-fd-leaks.patch bash-4.2-1240994-case-in-command-subst.patch bash-setlocale.patchbash-3.2-audit.patch bash-4.1-here-strings.patch bash-4.2-1250070-ifs-in-temp-env.patch bash-sighup.patchbash-3.2-ssh_source_bash.patch bash-4.1-history-hang.patch bash-4.2-1260568-bash-debugger.patch bash-tty-tests.patchbash-4.0-nobits.patch bash-4.1-logout.patch bash-4.2-cve-2014-7169-0.patch dot-bash_logoutbash-4.1 bash-4.1-loop-bracket-comsub.patch bash-4.2-cve-2014-7169-1.patch dot-bash_profilebash41-001 bash-4.1-manpage.patch bash-4.2-cve-2014-7169-2.patch dot-bashrcbash41-002 bash-4.1-manpage_trap.patch bash-4.2-param-subst-mem-leak.patchbash41-016 bash-4.1-mem-leaks.patch bash-4.3-cve-2016-0634.patchbash41-017 bash-4.1-noecho.patch bash-4.3-cve-2016-7543.patch[root@repo SOURCES]# cd ..[root@repo rpmbuild]# cd SPECS/[root@repo SPECS]# lsbash.spec[root@repo SPECS]# vim bash.spec# Other patchesPatch101: bash-2.02-security.patchPatch102: bash-2.03-paths.patchPatch103: bash-2.03-profile.patchPatch104: bash-2.05a-interpreter.patchPatch105: bash-2.05b-debuginfo.patchPatch106: bash-2.05b-manso.patchPatch107: bash-2.05b-pgrp_sync.patchPatch108: bash-2.05b-readline-oom.patchPatch109: bash-2.05b-xcc.patchPatch110: bash-3.2-audit.patchPatch112: bash-3.2-ssh_source_bash.patchPatch113: bash-bashbug.patchPatch115: bash-infotags.patchPatch116: bash-requires.patchPatch117: bash-setlocale.patchPatch118: bash-tty-tests.patchPatch119: bash_history_syslog.patch #增加的内容......# Other patches%patch101 -p1 -b .security%patch102 -p1 -b .paths%patch103 -p1 -b .profile%patch104 -p1 -b .interpreter%patch105 -p1 -b .debuginfo%patch106 -p1 -b .manso%patch107 -p1 -b .pgrp_sync%patch108 -p1 -b .readline_oom%patch109 -p1 -b .xcc%patch110 -p1 -b .audit%patch112 -p1 -b .ssh_source_bash%patch113 -p1 -b .bashbug%patch115 -p1 -b .infotags%patch116 -p1 -b .requires%patch117 -p1 -b .setlocale%patch118 -p1 -b .tty_tests%patch119 -p1 -b .history_syslog #增加的内容%patch123 -p1 -b .nobits%patch124 -p1 -b .examples%patch125 -p1 -b .bind_int_variable%patch126 -p1 -b .broken_pipe%patch127 -p1 -b .manpage%patch128 -p1 -b .defer-sigchld-trap
[root@repo ~]# yum install texinfo #在另一窗口安装[root@repo SPECS]# rpmbuild -ba bash.spec+ exit 0Processing files: bash-4.1.2-48.el6.x86_64Provides: config(bash) = 4.1.2-48.el6Requires(interp): /bin/shRequires(rpmlib): rpmlib(BuiltinLuaScripts) <= 4.2.2-1 rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1Requires(post): ncurses-libsRequires(postun): /bin/shRequires: /bin/sh libc.so.6()(64bit) libc.so.6(GLIBC_2.11)(64bit) libc.so.6(GLIBC_2.2.5)(64bit) libc.so.6(GLIBC_2.3)(64bit) libc.so.6(GLIBC_2.3.4)(64bit) libc.so.6(GLIBC_2.4)(64bit) libdl.so.2()(64bit) libdl.so.2(GLIBC_2.2.5)(64bit) libtinfo.so.5()(64bit) rtld(GNU_HASH)Processing files: bash-doc-4.1.2-48.el6.x86_64Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1Requires: /bin/bash /bin/shProcessing files: bash-debuginfo-4.1.2-48.el6.x86_64Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/rpmbuild/BUILDROOT/bash-4.1.2-48.el6.x86_64Wrote: /root/rpmbuild/SRPMS/bash-4.1.2-48.el6.src.rpmWrote: /root/rpmbuild/RPMS/x86_64/bash-4.1.2-48.el6.x86_64.rpmWrote: /root/rpmbuild/RPMS/x86_64/bash-doc-4.1.2-48.el6.x86_64.rpmWrote: /root/rpmbuild/RPMS/x86_64/bash-debuginfo-4.1.2-48.el6.x86_64.rpmExecuting(%clean): /bin/sh -e /var/tmp/rpm-tmp.0zbnT0+ umask 022+ cd /root/rpmbuild/BUILD+ cd bash-4.1+ rm -rf /root/rpmbuild/BUILDROOT/bash-4.1.2-48.el6.x86_64+ exit 0
四、重新安装bash
[root@repo rpmbuild]# cd RPMS[root@repo RPMS]# lltotal 4drwxr--r-- 2 root root 4096 Jul 25 13:08 x86_64[root@repo RPMS]# cd x86_64/[root@repo x86_64]# lltotal 5128-rw-r--r-- 1 root root 931232 Jul 25 13:08 bash-4.1.2-48.el6.x86_64.rpm-rw-r--r-- 1 root root 1374956 Jul 25 13:08 bash-debuginfo-4.1.2-48.el6.x86_64.rpm-rw-r--r-- 1 root root 2939332 Jul 25 13:08 bash-doc-4.1.2-48.el6.x86_64.rpm[root@repo x86_64]# rpm -Uvh --force bash-4.1.2-48.el6.x86_64.rpmPreparing... ########################################### [100%]1:bash ########################################### [100%]
五、配置rsyslog日志服务
[root@repo x86_64]# cat /etc/rsyslog.conflocal1.debug /var/log/bash_history.log
[root@repo x86_64]# tail -f /var/log/bash_history.logJul 25 13:10:28 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root cd x86_64/Jul 25 13:10:30 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root llJul 25 13:12:57 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root bash --versionJul 25 13:13:46 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root rpm -Uvh --force bash-4.1.2-48.el6.x86_64.rpmJul 25 13:13:49 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root llJul 25 13:15:04 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root cp bash-4.1.2-48.el6.x86_64.rpm /var/repo/other_x86_64/Jul 25 13:15:17 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root cat /etc/rsyslog.confJul 25 13:15:33 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root ll /var/log/bash_history.logJul 25 13:15:48 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root more /var/log/bash_history.logJul 25 13:16:19 repo -bash: HISTORY: PPID=29829 PID=29831 SID=29831 UID=0 User=root tail -f /var/log/bash_history.logJul 25 13:16:30 repo -bash: HISTORY: PPID=5208 PID=5210 SID=5210 UID=0 User=root ll