[Auditbeat] Fix issues with multiple calls to rpmReadConfigFiles (ela…

…stic#12168)

This patch fixes two issues in Auditbeat's system/package on RPM
distros:

- Multiple calls to rpmReadConfigFiles lead to a crash (segmentation
  fault). It is necessary to call rpmFreeRpmrc after each call to
  rpmReadConfigFiles.

  See [1] for a similar issue.

- In addition, it is also necessary to call rpmFreeMacros (when
  available) to avoid leaking memory after each
  rpmReadConfigFiles call.

1: https://lists.fedorahosted.org/pipermail/anaconda-patches/2015-February/015826.html

Fixes elastic#12147

CHANGELOG.next.asciidoc

@@ -80,6 +80,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Package dataset: Log error when Homebrew is not installed. {pull}11667[11667]
 - Process dataset: Fixed a memory leak under Windows. {pull}12100[12100]
 - Login dataset: Fix re-read of utmp files. {pull}12028[12028]
+- Package dataset: Fixed a crash inside librpm after Auditbeat has been running for a while. {issue}12147[12147] {pull}12168[12168]
 
 *Filebeat*
 

x-pack/auditbeat/module/system/package/rpm_linux.go

@@ -33,6 +33,20 @@ my_rpmtsCreate(void *f) {
   return rpmtsCreate();
 }
 
+void
+my_rpmFreeMacros(void *f) {
+	void (*rpmFreeMacros)(void *);
+	rpmFreeMacros = (void(*)(void*))f;
+    rpmFreeMacros(NULL);
+}
+
+void
+my_rpmFreeRpmrc(void *f) {
+	void (*rpmFreeRpmrc)(void);
+	rpmFreeRpmrc = (void (*)(void))f;
+	rpmFreeRpmrc();
+}
+
 int
 my_rpmReadConfigFiles(void *f) {
   int (*rpmReadConfigFiles)(const char*, const char*);
@@ -163,6 +177,8 @@ type cFunctions struct {
 	rpmdbFreeIterator       unsafe.Pointer
 	rpmtsFree               unsafe.Pointer
 	rpmsqSetInterruptSafety unsafe.Pointer
+	rpmFreeRpmrc            unsafe.Pointer
+	rpmFreeMacros           unsafe.Pointer
 }
 
 var cFun *cFunctions
@@ -238,10 +254,19 @@ func dlopenCFunctions() (*cFunctions, error) {
 		return nil, err
 	}
 
+	cFun.rpmFreeRpmrc, err = librpm.GetSymbolPointer("rpmFreeRpmrc")
+	if err != nil {
+		return nil, err
+	}
+
 	// Only available in librpm>=4.13.0
 	cFun.rpmsqSetInterruptSafety, err = librpm.GetSymbolPointer("rpmsqSetInterruptSafety")
 	// no error check
 
+	// Only available in librpm>=4.6.0
+	cFun.rpmFreeMacros, err = librpm.GetSymbolPointer("rpmFreeMacros")
+	// no error check
+
 	return &cFun, nil
 }
 
@@ -271,10 +296,15 @@ func listRPMPackages() ([]*Package, error) {
 		return nil, fmt.Errorf("Failed to get rpmts")
 	}
 	defer C.my_rpmtsFree(cFun.rpmtsFree, rpmts)
+
 	res := C.my_rpmReadConfigFiles(cFun.rpmReadConfigFiles)
 	if int(res) != 0 {
 		return nil, fmt.Errorf("Error: %d", int(res))
 	}
+	defer C.my_rpmFreeRpmrc(cFun.rpmFreeRpmrc)
+	if cFun.rpmFreeMacros != nil {
+		defer C.my_rpmFreeMacros(cFun.rpmFreeMacros)
+	}
 
 	mi := C.my_rpmtsInitIterator(cFun.rpmtsInitIterator, rpmts)
 	if mi == nil {