Source Mage code commit list

[Arjan Bouter <scm AT sourcemage.org>]

GIT changes to master grimoire by Arjan Bouter <abouter AT sourcemage.org>:

 ChangeLog                  |    1 +
 security/tct/BUILD         |    1 +
 security/tct/DEPENDS       |   17 +++++++++++++++++
 security/tct/DETAILS       |   27 +++++++++++++++++++++++++++
 security/tct/FINAL         |    1 +
 security/tct/HISTORY       |    2 ++
 security/tct/INSTALL       |    2 ++
 security/tct/PRE_BUILD     |    3 +++
 security/tct/fstools.patch |   10 ++++++++++
 9 files changed, 64 insertions(+)

New commits:
commit 789c509370b27c341ac7d4e5a3c9fa93730182d9
Author: Arjan Bouter <abouter AT sourcemage.org>
Commit: Arjan Bouter <abouter AT sourcemage.org>

    tct: new spell, the coroner's toolkit. forensics toolkit

diff --git a/ChangeLog b/ChangeLog
index 6cb5c11..2e20913 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,7 @@
          calculator
 
 2009-07-27 Arjan Bouter <abouter AT sourcemage.org>
+       * security/tct: new spell, the coroner's toolkit, forensics toolkit
        * wm-addons/batterymon: new spell, battery applet
        * wm-addons/ibam: new spell, apm battery monitor with optional
          gkrellm(2) plugin
diff --git a/security/tct/BUILD b/security/tct/BUILD
new file mode 100755
index 0000000..8f58e6d
--- /dev/null
+++ b/security/tct/BUILD
@@ -0,0 +1 @@
+make
diff --git a/security/tct/DEPENDS b/security/tct/DEPENDS
new file mode 100755
index 0000000..96d70ea
--- /dev/null
+++ b/security/tct/DEPENDS
@@ -0,0 +1,17 @@
+depends gcc &&
+depends perl &&
+optional_depends lsof '' '' 'Find open files (highly recommended)' &&
+optional_depends CRON '' '' 'Inspect cron?' &&
+optional_depends rpm '' '' 'use rpm?' &&
+optional_depends yp-tools '' '' 'for ypcat and ypwhich' &&
+optional_depends uudeview '' '' 'for uudecode' &&
+optional_depends bsd-finger '' '' 'for finger' &&
+optional_depends  'nfs-utils' '' 'for nfs support' &&
+optional_depends  at '' '' 'use at?' &&
+optional_depends  'netkit-ftp' '' 'for ftp support'
+optional_depends  nmap '' '' 'use nmap?' &&
+optional_depends  strace '' '' 'use strace?'
+
+#please help complete the list of apps:
+#acctcom, devinfo, eeprom, format, modstat, pkginfo, pstat
+#rusers, showmount, showrev, swap
diff --git a/security/tct/DETAILS b/security/tct/DETAILS
new file mode 100755
index 0000000..149c827
--- /dev/null
+++ b/security/tct/DETAILS
@@ -0,0 +1,27 @@
+           SPELL=tct
+         VERSION=1.18
+          SOURCE="${SPELL}-${VERSION}.tar.gz"
+   SOURCE_URL[0]=http://www.porcupine.org/forensics/${SOURCE}
+     
SOURCE_HASH=sha512:aea6e599e4e81cc6d320c36e181ee9478899cb85d13d3ea2a2bd90c223b43b919f8c9ee25826b7aada3fe402204a94a87b7142af97d79570e22cef60f8434a26
+SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
+        WEB_SITE="http://www.porcupine.org/forensics/tct.html";
+      LICENSE[0]=IBMPL
+            DOCS="$DOCS CHANGES Beware quick-start help-recovering-file 
help-when-broken-into"
+         ENTERED=20090727
+           SHORT="The coroner's toolkit"
+cat << EOF
+TCT is a collection of programs by Dan Farmer and Wietse Venema for a
+post-mortem analysis of a UNIX system after break-in.
+The programs are all either oriented towards gathering or analyzing
+forensic data on a Unix system.  There is no single task or ultimate
+goal that they are directed to, but if there was a theme it'd be an
+effort towards the reconstruction of the past - determining as much
+as possible what happened with a static snapshot of a system.  Most of
+the tools are oriented towards data collection rather than analysis -
+a good use of the toolkit could be for a relative neophyte in Unix
+forensic security to send the data to someone who does know something and
+can further analyze the output.
+
+Examples of using TCT can be found in the Forensic Discovery book.
+(Last draft available for free in HTML form on the website)
+EOF
diff --git a/security/tct/FINAL b/security/tct/FINAL
new file mode 100755
index 0000000..ff53253
--- /dev/null
+++ b/security/tct/FINAL
@@ -0,0 +1 @@
+message "${PROBLEM_COLOR}Warning, ${SPELL} is installed in /opt and is 
supposed to be run from there${DEFAULT_COLOR}"
diff --git a/security/tct/HISTORY b/security/tct/HISTORY
new file mode 100644
index 0000000..67eb127
--- /dev/null
+++ b/security/tct/HISTORY
@@ -0,0 +1,2 @@
+2009-07-27 Arjan Bouter <abouter AT sourcemage.org>
+       * BUILD, DETAILS, DEPENDS, INSTALL, FINAL, PRE_BUILD: spell created
diff --git a/security/tct/INSTALL b/security/tct/INSTALL
new file mode 100755
index 0000000..fe1f2d4
--- /dev/null
+++ b/security/tct/INSTALL
@@ -0,0 +1,2 @@
+mkdir -p ${INSTALL_ROOT}/opt/tct &&
+cp -a ${SOURCE_DIRECTORY}/* ${INSTALL_ROOT}/opt/tct/
diff --git a/security/tct/PRE_BUILD b/security/tct/PRE_BUILD
new file mode 100755
index 0000000..30f2e29
--- /dev/null
+++ b/security/tct/PRE_BUILD
@@ -0,0 +1,3 @@
+default_pre_build &&
+cd ${SOURCE_DIRECTORY} &&
+patch -p1 < ${SCRIPT_DIRECTORY}/fstools.patch
diff --git a/security/tct/fstools.patch b/security/tct/fstools.patch
new file mode 100644
index 0000000..758b6c8
--- /dev/null
+++ b/security/tct/fstools.patch
@@ -0,0 +1,10 @@
+--- tct-1.18-orig/src/fstools/fs_tools.h       2007-04-09 15:30:32.000000000 
+0200
++++ tct-1.18-fixed/src/fstools/fs_tools.h      2009-07-27 18:31:01.934766046 
+0200
+@@ -201,6 +201,7 @@
+   */
+ #if defined(LINUX2)
+ #define SUPPORTED
++#include <linux/fs.h>
+ #include <linux/ext2_fs.h>
+ #define HAVE_EXT2FS
+ #define HAVE_DTIME