Bug 2196807

Summary: Systemd-analyze security reports false information
Product: Red Hat Enterprise Linux 8 Reporter: Attila Lakatos <alakatos>
Component: systemdAssignee: David Tardon <dtardon>
Status: POST --- QA Contact: Frantisek Sumsal <fsumsal>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.9CC: dtardon, jamacku, systemd-maint-list
Target Milestone: rcKeywords: Bugfix, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Attila Lakatos 2023-05-10 09:46:35 UTC 
Description of problem:
The output of 'systemd-analyze security rsyslog.service' generates false output in some cases, see below.

Version-Release number of selected component (if applicable):
systemd-239-75.el8.x86_64

How reproducible:
always

Steps to Reproduce:
1. systemd-analyze security rsyslog.service
...
✗ SystemCallFilter=~@clock Service does not filter system calls  0.2
✗ SystemCallFilter=~@debug Service does not filter system calls  0.2
✗ SystemCallFilter=~@module Service does not filter system calls 0.2
✗ SystemCallFilter=~@mount Service does not filter system calls  0.2
✗ SystemCallFilter=~@raw-io Service does not filter system calls 0.2
✗ SystemCallFilter=~@reboot Service does not filter system calls 0.2
✗ SystemCallFilter=~@swap Service does not filter system calls 0.2
✗ SystemCallFilter=~@privileged Service does not filter system calls 0.2
✗ SystemCallFilter=~@resources Service does not filter system calls 0.2
...
3. After review, I added the following line to the rsyslog service file (/usr/lib/systemd/system/rsyslog.service):
SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete
4. systemctl daemon-reload && systemctl restart rsyslog

Actual results:
systemd-analyze still reports that the systemcallfilters are not present.

Expected results:
systemd-analyze should not report that the systemcallfilters are not present.

Additional info:
On rhel-9.3 with systemd-252-13.el9_2.x86_64, the problem can not be reproduced.