/sbin/auditd and GSS (was: audit 1.7.6 released)

[Tony Jones]

On Sat, Sep 13, 2008 at 02:32:54PM -0400, Steve Grubb wrote:
> On Thursday 11 September 2008 19:39:27 Steve Grubb wrote:
> > I've just released a new version of the audit daemon.
> 
> There will be a 1.7.7 release early next week. It will include the GSSAPI 
> patch sent yesterday and a fix to a tcp_wrappers problem reported today. Code 
> review of GSSAPI support shows that we may need to make a couple more changes 
> to it before people start widely deploying it. This should all be taken care 
> of in 1.7.7 which I am hoping to be able to release soon.

When I try to build here at SuSE our buildsystem flags the following:

binary /sbin/auditd is linked against libraries in /usr or /opt
        libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0xb7f65000)
        libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0xb7d75000)
        libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0xb7d50000)
        libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0xb7d43000)

You mentioned (on IRC) rsyslog being another /sbin executable which made use
of GSS but (at least for the package I had access to) the GSS dependancies are 
isolated to the rsyslog-module-gssapi module.   Modules are loaded by rsyslog
based on configuration file using dlopen().

Clearly this is a bit smoke-n-mirror ish but the direct ldd depenancy between 
auditd and GSS is kinda problematic. I assume GSS resides in /usr/lib for
Fedora/RHEL too?  Clearly one don't have to configure GSS support in.

Appreciate any comments.

Tony