Auditbeat's system/package dataset loads librpm dynamically using dlopen. It finds the library using a hardcoded set of library version names:
|
func openLibrpm() (*librpm, error) { |
|
var librpmNames = []string{ |
|
"librpm.so", // with rpm-devel installed |
|
"librpm.so.9", // Fedora 31/32 |
|
"librpm.so.8", // Fedora 29/30 |
|
"librpm.so.3", // CentOS 7 |
|
"librpm.so.1", // CentOS 6 |
|
|
|
// Following for completeness, but not explicitly tested |
|
"librpm.so.10", |
|
"librpm.so.7", |
|
"librpm.so.6", |
|
"librpm.so.5", |
|
"librpm.so.4", |
|
"librpm.so.2", |
|
} |
We'd like to have something that is a less brittle.
Relates: #19275 (comment)
Relates: #19253
Auditbeat's system/package dataset loads librpm dynamically using
dlopen. It finds the library using a hardcoded set of library version names:beats/x-pack/auditbeat/module/system/package/rpm_linux.go
Lines 207 to 222 in 6fedaef
We'd like to have something that is a less brittle.
Relates: #19275 (comment)
Relates: #19253