Bug 2172600

Summary:	RFE: Add standalone command to start/stop/restart auditd instead of legacy scripts
Product:	[Fedora] Fedora	Reporter:	Timothée Ravier <travier>
Component:	audit	Assignee:	Steve Grubb <sgrubb>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	dustymabe, jlebon, scorreia, sgrubb
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-23 17:17:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Timothée Ravier 2023-02-22 16:30:27 UTC

Description of problem:

We're looking at adding audit into Fedora CoreOS (see discussion in https://github.com/coreos/fedora-coreos-tracker/issues/1362) and we would like to completly remove the dependency on the legacy `service` binary and related scripts.

We understand that using systemctl is not an option (from the discussion in https://bugzilla.redhat.com/show_bug.cgi?id=1768815) and we are interested in investigating other options.

For example, we could add an `auditdctl` binary that would accept the `start/stop/restart` commands and perform the required operations as needed to manage the daemon.

What would be the best path forward from your perspective?

We would be doing the development work.

Thanks

Comment 1 Steve Grubb 2023-02-22 16:37:13 UTC

auditctl --signal is available for use, although not terribly user friendly. I was considering making a second set of keywords that are more user friendly.

Comment 2 Steve Grubb 2023-02-22 19:28:26 UTC

Upstream commit 39802bf adds user friendly signal names.

Comment 3 Timothée Ravier 2023-08-23 17:17:04 UTC

https://github.com/linux-audit/audit-userspace/commit/39802bffbfc62501461c916d9ccf748afdff7d94 has been released in audit 3.1.1 which is now in Fedora.

Thanks!