Bug 2172600 - RFE: Add standalone command to start/stop/restart auditd instead of legacy scripts
Summary: RFE: Add standalone command to start/stop/restart auditd instead of legacy sc...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: audit
Version: rawhide
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Steve Grubb
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-02-22 16:30 UTC by Timothée Ravier
Modified: 2023-08-23 17:17 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-08-23 17:17:04 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Timothée Ravier 2023-02-22 16:30:27 UTC
Description of problem:

We're looking at adding audit into Fedora CoreOS (see discussion in https://github.com/coreos/fedora-coreos-tracker/issues/1362) and we would like to completly remove the dependency on the legacy `service` binary and related scripts.

We understand that using systemctl is not an option (from the discussion in https://bugzilla.redhat.com/show_bug.cgi?id=1768815) and we are interested in investigating other options.

For example, we could add an `auditdctl` binary that would accept the `start/stop/restart` commands and perform the required operations as needed to manage the daemon.

What would be the best path forward from your perspective?

We would be doing the development work.

Thanks

Comment 1 Steve Grubb 2023-02-22 16:37:13 UTC
auditctl --signal is available for use, although not terribly user friendly. I was considering making a second set of keywords that are more user friendly.

Comment 2 Steve Grubb 2023-02-22 19:28:26 UTC
Upstream commit 39802bf adds user friendly signal names.

Comment 3 Timothée Ravier 2023-08-23 17:17:04 UTC
https://github.com/linux-audit/audit-userspace/commit/39802bffbfc62501461c916d9ccf748afdff7d94 has been released in audit 3.1.1 which is now in Fedora.

Thanks!


Note You need to log in before you can comment on or make changes to this bug.