[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#54309] [PATCHv3] services: auditd: use exclusive log directory for
From: |
fesoj000 |
Subject: |
[bug#54309] [PATCHv3] services: auditd: use exclusive log directory for auditd |
Date: |
Wed, 23 Mar 2022 21:39:19 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.7.0 |
Use /var/log/audit for auditd. This is the upstream default.
* gnu/services/auditd.scm: add auditd-activation function and extend
activation-service-type.
---
gnu/services/auditd.scm | 28 +++++++++++++++++++++++-----
1 file changed, 23 insertions(+), 5 deletions(-)
diff --git a/gnu/services/auditd.scm b/gnu/services/auditd.scm
index abde811f51..33849155a1 100644
--- a/gnu/services/auditd.scm
+++ b/gnu/services/auditd.scm
@@ -26,15 +26,21 @@ (define-module (gnu services auditd)
#:use-module (guix records)
#:use-module (guix gexp)
#:use-module (guix packages)
+ #:use-module (guix modules)
#:export (auditd-configuration
auditd-service-type
%default-auditd-configuration-directory))
(define auditd.conf
- (plain-file "auditd.conf" "log_file = /var/log/audit.log\nlog_format = \
-ENRICHED\nfreq = 1\nspace_left = 5%\nspace_left_action = \
-syslog\nadmin_space_left_action = ignore\ndisk_full_action = \
-ignore\ndisk_error_action = syslog\n"))
+ (plain-file "auditd.conf" "\
+log_format = ENRICHED
+freq = 1
+space_left = 5%
+space_left_action = syslog
+admin_space_left_action = ignore
+disk_full_action = ignore
+disk_error_action = syslog
+"))
(define %default-auditd-configuration-directory
(computed-file "auditd"
@@ -50,6 +56,16 @@ (define-record-type* <auditd-configuration>
(default audit))
(configuration-directory auditd-configuration-configuration-directory))
; file-like
+(define (auditd-activation config)
+ (with-imported-modules (source-module-closure '((gnu build activation)
+ (guix build utils)))
+ #~(begin
+ (use-modules (gnu build activation)
+ (guix build utils))
+ ;; ensure /var/log exists with default permissions
+ (mkdir-p "/var/log")
+ (mkdir-p/perms "/var/log/audit" (getpwnam "root") #o700))))
+
(define (auditd-shepherd-service config)
(let* ((audit (auditd-configuration-audit config))
(configuration-directory
(auditd-configuration-configuration-directory config)))
@@ -67,7 +83,9 @@ (define auditd-service-type
(extensions
(list
(service-extension shepherd-root-service-type
- auditd-shepherd-service)))
+ auditd-shepherd-service)
+ (service-extension activation-service-type
+ auditd-activation)))
(default-value
(auditd-configuration
(configuration-directory
%default-auditd-configuration-directory)))))
--
2.34.0
- [bug#54309] What is the process from here?, (continued)
[bug#54309] [PATCH] services: auditd: use exclusive log directory for auditd, fesoj000, 2022/03/19
[bug#54309] [PATCHv2] services: auditd: use exclusive log directory for auditd, fesoj000, 2022/03/23
[bug#54309] [PATCHv3] services: auditd: use exclusive log directory for auditd,
fesoj000 <=