system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-01 07:34:28 +00:00
Code Issues Projects Releases Wiki Activity

journal: give the ability to enable/disable systemd-journald-audit.socket

Browse Source 
Before this patch the only way to prevent journald from reading the audit
messages was to mask systemd-journald-audit.socket. However this had main
drawback that downstream couldn't ship the socket disabled by default (beside
the fact that masking units is not supposed to be the usual way to disable
them).

Fixes #15777
This commit is contained in:
Franck Bui 2022-12-06 20:15:43 +01:00 committed by Lennart Poettering
parent 8112c91e48
commit 2aba77057e
7 changed files with 28 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
man/journald.conf.xml
View File

@ -423,13 +423,18 @@
<varlistentry>
<term><varname>Audit=</varname></term>
<listitem><para>Takes a boolean value. If enabled <command>systemd-journal</command> will turn on
<listitem><para>Takes a boolean value. If enabled <command>systemd-journald</command> will turn on
kernel auditing on start-up. If disabled it will turn it off. If unset it will neither enable nor
disable it, leaving the previous state unchanged. Note that this option does not control whether
<command>systemd-journald</command> collects generated audit records, it just controls whether it
tells the kernel to generate them. This means if another tool turns on auditing even if
<command>systemd-journald</command> left it off, it will still collect the generated
messages. Defaults to on.</para></listitem>
disable it, leaving the previous state unchanged. This means if another tool turns on auditing even
if <command>systemd-journald</command> left it off, it will still collect the generated
messages. Defaults to on.</para>
<para>Note that this option does not control whether <command>systemd-journald</command> collects
generated audit records, it just controls whether it tells the kernel to generate them. If you need
to prevent <command>systemd-journald</command> from collecting the generated messages, the socket
unit <literal>systemd-journald-audit.socket</literal> can be disabled and in this case this setting
is without effect.</para>
</listitem>
</varlistentry>
<varlistentry>

4
man/systemd-journald.service.xml
View File

@ -332,7 +332,9 @@ systemd-tmpfiles --create --prefix /var/log/journal</programlisting>
<listitem><para>Sockets and other file node paths that <command>systemd-journald</command> will
listen on and are visible in the file system. In addition to these,
<command>systemd-journald</command> can listen for audit events using <citerefentry
project='man-pages'><refentrytitle>netlink</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para></listitem>
project='man-pages'><refentrytitle>netlink</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
depending on whether <literal>systemd-journald-audit.socket</literal> is enabled or
not.</para></listitem>
</varlistentry>
</variablelist>

1
presets/90-systemd.preset
View File

@ -24,6 +24,7 @@ enable systemd-homed.service
enable systemd-userdbd.socket
enable systemd-pstore.service
enable systemd-boot-update.service
enable systemd-journald-audit.socket
disable console-getty.service
disable debug-shell.service

5
src/journal/journald-server.c
View File

@ -2504,10 +2504,13 @@ int server_init(Server *s, const char *namespace) {
/* Unless we got *some* sockets and not audit, open audit socket */
if (s->audit_fd >= 0 || no_sockets) {
log_info("Collecting audit messages is enabled.");
r = server_open_audit(s);
if (r < 0)
return r;
}
} else
log_info("Collecting audit messages is disabled.");
r = server_open_varlink(s, varlink_socket, varlink_fd);
if (r < 0)

3
units/meson.build
View File

@ -123,8 +123,7 @@ units = [
'sysinit.target.wants/'],
['systemd-journal-gatewayd.socket', 'ENABLE_REMOTE HAVE_MICROHTTPD'],
['systemd-journal-remote.socket', 'ENABLE_REMOTE HAVE_MICROHTTPD'],
['systemd-journald-audit.socket', '',
'sockets.target.wants/'],
['systemd-journald-audit.socket', ''],
['systemd-journald-dev-log.socket', '',
'sockets.target.wants/'],
['systemd-journald.socket', '',

4
units/systemd-journald-audit.socket
View File

@ -20,3 +20,7 @@ Service=systemd-journald.service
ReceiveBuffer=128M
ListenNetlink=audit 1
PassCredentials=yes
[Install]
WantedBy=sockets.target
WantedBy=systemd-journald.service

5
units/systemd-journald.service.in
View File

@ -38,7 +38,10 @@ RestrictRealtime=yes
RestrictSUIDSGID=yes
RuntimeDirectory=systemd/journal
RuntimeDirectoryPreserve=yes
Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket
# Audit socket is not listed here because this unit can be turned off. However
# the link between the socket and the service units is still created thanks to
# the 'Service=' setting specified in the socket unit.
Sockets=systemd-journald.socket systemd-journald-dev-log.socket
StandardOutput=null
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM