Add rpm packaging rebase

[tsg]

This takes over the code from #9092 and rebases it on top of master.

This adds support for programmatically reading the list of RPM packages. The previous version was using exec (called the rpm binary), but we'd like to keep Auditbeat exec free, because execs are currently blocked by seccomp, as a security feature.

Using the model from Journalbeat, the new code uses dlopen get the relevant C functions and calls them using CGo. This means that librpm is not a hard dependency, but only for when this functionality is needed.

[elasticmachine]

Pinging @elastic/secops

[tsg]

jenkins, test this plz

[andrewkroh]

linux,cgo better reflects the requirements of the file. Likewise anywhere that uses a tag that's meant to be the opposite should be updated (I think that would be // +build !linux !cgo).

You'll want to update anything that depends on this file directly to include the same label. This should allow for CGO_ENABLED=0 go build to still work on Linux.

[tsg]

Thanks, should be done with the latest commit. I tested CGO_ENABLED=0 go build on linux.

[andrewkroh]

Code LGTM. There is a doc page that mentions this only works on dpkg type systems. That needs to be updated.

https://www.elastic.co/guide/en/beats/auditbeat/master/auditbeat-dataset-system-package.html#auditbeat-dataset-system-package

[tsg]

jenkins, test this plz

[cwurm]

Thanks for rebasing it, @tsg! Just one test failure on Windows related to build constraints (see comment), and the docs page @andrewkroh mentioned.

LGTM otherwise, if the relevant parts of CI go green.

[cwurm]

Should be // +build !linux,!windows !cgo,!windows, I think. The definition for Package is not available for Windows because package.go is // +build !windows.

[tsg]

Thanks, trying it as an extra // + build !windows line, I think that should work as well.

[cwurm]

There is a system test in test_metricsets.py that will need its run condition updated:

beats/x-pack/auditbeat/tests/system/test_metricsets.py

Line 44 in 0e4f938

@unittest.skipIf(sys.platform == "linux2" and platform.linux_distribution()[0] != "debian",

Unfortunately, it's already wrong at the moment (testing for "debian" which does not cover Ubuntu). I'd have fixed it but didn't want to cause a merge conflict here. It's tricky because Python does not have an exact out of the box equivalent to the Go code (which ultimately parses /etc/lsb-release).

Maybe we could do:

@unittest.skipIf(sys.platform == "linux2" and not (os.path.isdir("/var/lib/dpkg") or os.path.isdir("/var/lib/rpm")),
                     "Only implemented for dpkg and rpm")

[tsg]

jenkins, test this pls

[tsg]

jenkins, test this

[tsg]

jenkins, test this just one more time

[tsg]

All green except an unrelated Metricbeat test. I was hoping for an all-green, but I think this is good to merge.