[packages/apache-mod_security_crs] Rel 3. CRS rule matches to the audit log only; anomaly verdicts keep one error_log line

[arekm]

commit ae5f35fd8a31925eada8a7bc9f50e1c37e74b1f6
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Tue Oct 6 08:10:37 2026 +0200

    Rel 3. CRS rule matches to the audit log only; anomaly verdicts keep one error_log line

 apache-mod_security_crs.conf   |  5 +++++
 apache-mod_security_crs.spec   | 10 +++++++---
 crs-setup-audit-log-only.patch | 40 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 3 deletions(-)
---
diff --git a/apache-mod_security_crs.spec b/apache-mod_security_crs.spec
index 3680ef2..73c14b6 100644
--- a/apache-mod_security_crs.spec
+++ b/apache-mod_security_crs.spec
@@ -4,12 +4,13 @@ Summary(pl.UTF-8):	Aktywacja OWASP Core Rule Set dla modułu mod_security Apache
 Name:		apache-mod_security_crs
 # loader layout follows CRS 4 (plugins/*-{config,before,after}.conf), not a CRS release
 Version:	4.0
-Release:	2
+Release:	3
 License:	Apache v2.0
 Group:		Networking/Daemons/HTTP
 Source0:	%{name}.conf
 Source1:	REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
 Source2:	RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
+Patch0:		crs-setup-audit-log-only.patch
 URL:		https://coreruleset.org/
 # crs-setup.conf.example is copied at build time
 BuildRequires:	modsecurity-crs >= 4
@@ -36,6 +37,10 @@ wymaganej przez CRS. Plik konfiguracyjny CRS dla Apache'a to
 /etc/httpd/modsecurity-crs/crs-setup.conf.
 
 %prep
+%setup -q -c -T
+# rule 901001 rejects every request unless a setup file is loaded before rules/
+cp -p %{_datadir}/modsecurity-crs/crs-setup.conf.example crs-setup.conf
+%patch -P0 -p1
 
 %build
 
@@ -44,8 +49,7 @@ rm -rf $RPM_BUILD_ROOT
 install -d $RPM_BUILD_ROOT%{apacheconfdir}/{conf.d/modsecurity.d,modsecurity-crs}
 
 cp -p %{SOURCE0} $RPM_BUILD_ROOT%{apacheconfdir}/conf.d/modsecurity.d/modsecurity_crs.conf
-# rule 901001 rejects every request unless a setup file is loaded before rules/
-cp -p %{_datadir}/modsecurity-crs/crs-setup.conf.example $RPM_BUILD_ROOT%{apacheconfdir}/modsecurity-crs/crs-setup.conf
+cp -p crs-setup.conf $RPM_BUILD_ROOT%{apacheconfdir}/modsecurity-crs/crs-setup.conf
 cp -p %{SOURCE1} %{SOURCE2} $RPM_BUILD_ROOT%{apacheconfdir}/modsecurity-crs
 
 %clean
diff --git a/apache-mod_security_crs.conf b/apache-mod_security_crs.conf
index f7110da..5f6bd6a 100644
--- a/apache-mod_security_crs.conf
+++ b/apache-mod_security_crs.conf
@@ -6,5 +6,10 @@ Include /usr/share/modsecurity-crs/plugins/*-config.conf
 Include /usr/share/modsecurity-crs/plugins/*-before.conf
 Include modsecurity-crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
 Include /usr/share/modsecurity-crs/rules/*.conf
+# crs-setup.conf logs rule matches to the audit log only; the anomaly verdicts
+# also go to error_log, one line per request carrying its unique_id - without
+# "log" a block would leave no error_log trace at all
+SecRuleUpdateActionById 949110 "log"
+SecRuleUpdateActionById 959100 "log"
 Include /usr/share/modsecurity-crs/plugins/*-after.conf
 Include modsecurity-crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
diff --git a/crs-setup-audit-log-only.patch b/crs-setup-audit-log-only.patch
new file mode 100644
index 0000000..2780b62
--- /dev/null
+++ b/crs-setup-audit-log-only.patch
@@ -0,0 +1,40 @@
+Anomaly scoring logs rule matches to the audit log only: mod_security2 writes every
+matching rule to error_log as well, so each hit lands twice. The verdicts (949110, 959100)
+keep one error_log line per request, see apache-mod_security_crs.conf.
+
+--- a/crs-setup.conf
++++ b/crs-setup.conf
+@@ -94,11 +94,11 @@
+ # - In Apache, you can use ErrorDocument to show a friendly error page or
+ #   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+ #
+-SecDefaultAction "phase:1,log,auditlog,pass"
+-SecDefaultAction "phase:2,log,auditlog,pass"
+-SecDefaultAction "phase:3,log,auditlog,pass"
+-SecDefaultAction "phase:4,log,auditlog,pass"
+-SecDefaultAction "phase:5,log,auditlog,pass"
++# SecDefaultAction "phase:1,log,auditlog,pass"
++# SecDefaultAction "phase:2,log,auditlog,pass"
++# SecDefaultAction "phase:3,log,auditlog,pass"
++# SecDefaultAction "phase:4,log,auditlog,pass"
++# SecDefaultAction "phase:5,log,auditlog,pass"
+ 
+ # Example: Anomaly Scoring mode, log only to ModSecurity audit log
+ # - By default, offending requests are blocked with an error 403 response.
+@@ -107,11 +107,11 @@
+ # - In Apache, you can use ErrorDocument to show a friendly error page or
+ #   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+ #
+-# SecDefaultAction "phase:1,nolog,auditlog,pass"
+-# SecDefaultAction "phase:2,nolog,auditlog,pass"
+-# SecDefaultAction "phase:3,nolog,auditlog,pass"
+-# SecDefaultAction "phase:4,nolog,auditlog,pass"
+-# SecDefaultAction "phase:5,nolog,auditlog,pass"
++SecDefaultAction "phase:1,nolog,auditlog,pass"
++SecDefaultAction "phase:2,nolog,auditlog,pass"
++SecDefaultAction "phase:3,nolog,auditlog,pass"
++SecDefaultAction "phase:4,nolog,auditlog,pass"
++SecDefaultAction "phase:5,nolog,auditlog,pass"
+ 
+ # Example: Self-contained mode, return error 403 on blocking
+ # - In this configuration the default disruptive action becomes 'deny'. After a
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/apache-mod_security_crs.git/commitdiff/ae5f35fd8a31925eada8a7bc9f50e1c37e74b1f6