GNU bug report logs - #54309
[PATCH] services: auditd: use exclusive log directory for auditd

Previous Next

Full log

Message #68 received at 54309 <at> debbugs.gnu.org (full text, mbox):

From: fesoj000 <fesoj000 <at> gmail.com>
To: 54309 <at> debbugs.gnu.org
Subject: [PATCHv3] services: auditd: use exclusive log directory for auditd
Date: Wed, 23 Mar 2022 21:39:19 +0100

Use /var/log/audit for auditd. This is the upstream default.

* gnu/services/auditd.scm: add auditd-activation function and extend
activation-service-type.
---
 gnu/services/auditd.scm | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/gnu/services/auditd.scm b/gnu/services/auditd.scm
index abde811f51..33849155a1 100644
--- a/gnu/services/auditd.scm
+++ b/gnu/services/auditd.scm
@@ -26,15 +26,21 @@ (define-module (gnu services auditd)
   #:use-module (guix records)
   #:use-module (guix gexp)
   #:use-module (guix packages)
+  #:use-module (guix modules)
   #:export (auditd-configuration
             auditd-service-type
             %default-auditd-configuration-directory))
 
 (define auditd.conf
-  (plain-file "auditd.conf" "log_file = /var/log/audit.log\nlog_format = \
-ENRICHED\nfreq = 1\nspace_left = 5%\nspace_left_action = \
-syslog\nadmin_space_left_action = ignore\ndisk_full_action = \
-ignore\ndisk_error_action = syslog\n"))
+  (plain-file "auditd.conf" "\
+log_format = ENRICHED
+freq = 1
+space_left = 5%
+space_left_action = syslog
+admin_space_left_action = ignore
+disk_full_action = ignore
+disk_error_action = syslog
+"))
 
 (define %default-auditd-configuration-directory
   (computed-file "auditd"
@@ -50,6 +56,16 @@ (define-record-type* <auditd-configuration>
                            (default audit))
   (configuration-directory auditd-configuration-configuration-directory))      ; file-like
 
+(define (auditd-activation config)
+  (with-imported-modules (source-module-closure '((gnu build activation)
+                                                  (guix build utils)))
+    #~(begin
+        (use-modules (gnu build activation)
+                     (guix build utils))
+        ;; ensure /var/log exists with default permissions
+        (mkdir-p "/var/log")
+        (mkdir-p/perms "/var/log/audit" (getpwnam "root") #o700))))
+
 (define (auditd-shepherd-service config)
   (let* ((audit (auditd-configuration-audit config))
          (configuration-directory (auditd-configuration-configuration-directory config)))
@@ -67,7 +83,9 @@ (define auditd-service-type
                 (extensions
                  (list
                   (service-extension shepherd-root-service-type
-                                     auditd-shepherd-service)))
+                                     auditd-shepherd-service)
+                  (service-extension activation-service-type
+                                     auditd-activation)))
                 (default-value
                   (auditd-configuration
                    (configuration-directory %default-auditd-configuration-directory)))))
-- 
2.34.0

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.