system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-10-06 16:21:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

core: introduce ConditionSecurity=audit

Browse source 
And conditionalize journald audit support with it
This commit is contained in:
Lennart Poettering 2014-11-03 21:09:38 +01:00
parent 875c2e220e
commit cfb1f5df7c
5 changed files with 32 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
man/systemd.unit.xml
View file

@ -1080,14 +1080,15 @@
<para><varname>ConditionSecurity=</varname>
may be used to check whether the given
security module is enabled on the
system. Currently the recognized values
values are <varname>selinux</varname>,
system. Currently the recognized
values values are
<varname>selinux</varname>,
<varname>apparmor</varname>,
<varname>ima</varname> and
<varname>smack</varname>.
The test may be negated by prepending
an exclamation
mark.</para>
<varname>ima</varname>,
<varname>smack</varname> and
<varname>audit</varname>. The test may
be negated by prepending an
exclamation mark.</para>
<para><varname>ConditionCapability=</varname>
may be used to check whether the given

3
src/core/condition.c
View file

@ -38,6 +38,7 @@
#include "apparmor-util.h"
#include "ima-util.h"
#include "selinux-util.h"
#include "audit.h"
static bool condition_test_security(Condition *c) {
assert(c);
@ -50,6 +51,8 @@ static bool condition_test_security(Condition *c) {
return mac_smack_use() == !c->negate;
if (streq(c->parameter, "apparmor"))
return mac_apparmor_use() == !c->negate;
if (streq(c->parameter, "audit"))
return use_audit() == !c->negate;
if (streq(c->parameter, "ima"))
return use_ima() == !c->negate;

18
src/shared/audit.c
View file

@ -80,3 +80,21 @@ int audit_loginuid_from_pid(pid_t pid, uid_t *uid) {
*uid = (uid_t) u;
return 0;
}
bool use_audit(void) {
static int cached_use = -1;
if (cached_use < 0) {
int fd;
fd = socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_AUDIT);
if (fd < 0)
cached_use = errno != EAFNOSUPPORT && errno != EPROTONOSUPPORT;
else {
cached_use = true;
safe_close(fd);
}
}
return cached_use;
}

2
src/shared/audit.h
View file

@ -27,3 +27,5 @@
int audit_session_from_pid(pid_t pid, uint32_t *id);
int audit_loginuid_from_pid(pid_t pid, uid_t *uid);
bool use_audit(void);

1
units/systemd-journald-audit.socket
View file

@ -10,6 +10,7 @@ Description=Journal Audit Socket
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target
ConditionSecurity=audit
[Socket]
Service=systemd-journald.service