New Package Request: audit #1362

c4rt0 · 2022-12-12T16:45:40Z

What, if any, are the additional dependencies on the package? (i.e. does it pull in Python, Perl, etc)

[root@cosa-devsh ~]# rpm-ostree install --dry-run audit
...
Installing 2 packages:
  audit-3.0.9-1.fc37.x86_64 (fedora)
  initscripts-service-10.17-1.fc37.noarch (fedora)

What is the size of the package and its dependencies?

$ rpm -qi audit

Name        : audit
Version     : 3.0.9
Release     : 1.fc37
Architecture: x86_64
Install Date: Sat 05 Nov 2022 09:00:50
Group       : Unspecified
Size        : 684113
License     : GPLv2+
Signature   : RSA/SHA256, Tue 30 Aug 2022 00:18:08, Key ID f55ad3fb5323552a
Source RPM  : audit-3.0.9-1.fc37.src.rpm
Build Date  : Mon 29 Aug 2022 23:06:47
Build Host  : buildvm-x86-26.iad2.fedoraproject.org
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : http://people.redhat.com/sgrubb/audit/
Bug URL     : https://bugz.fedoraproject.org/audit
Summary     : User space tools for kernel auditing

$  rpm -qi initscripts-service                                                                                                                                                                  1 err  11:39:35 
Name        : initscripts-service
Version     : 10.17
Release     : 1.fc37
Architecture: noarch
Install Date: Sat 05 Nov 2022 08:43:04
Group       : Unspecified
Size        : 5832
License     : GPLv2
Signature   : RSA/SHA256, Wed 24 Aug 2022 09:18:04, Key ID f55ad3fb5323552a
Source RPM  : initscripts-10.17-1.fc37.src.rpm
Build Date  : Wed 24 Aug 2022 09:13:16
Build Host  : buildvm-x86-14.iad2.fedoraproject.org
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : https://github.com/fedora-sysv/initscripts
Bug URL     : https://bugz.fedoraproject.org/initscripts
Summary     : Support for service command

What problem are you trying to solve with this package? Or what functionality does the package provide?

The audit package contains the user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux 2.6 and later kernels.

Can the software provided by the package be run from a container? Explain why or why not.

Yes, in theory, but it's likely not supported and will probably not work well with host filesystem rules.

Can the tool(s) provided by the package be helpful in debugging container runtime issues?

No

Can the tool(s) provided by the package be helpful in debugging networking issues?

No

Is it possible to layer the package onto the base OS as a day 2 operation? Explain why or why not.

Yes

In the case of packages providing services and binaries, can the packaging be adjusted to just deliver binaries?

TODO: Fill in bugs tracking that from previous issue

Can the tool(s) provided by the package be used to do things we’d rather users not be able to do in FCOS?

N/A

Does the software provided by the package have a history of CVEs?

No

?? https://www.cvedetails.com/product/13730/Linux-Audit.html?vendor_id=33

The text was updated successfully, but these errors were encountered:

travier · 2022-12-12T16:46:55Z

For the first question we need the output of Paste here the output of rpm-ostree install --dry-run <package> from a fresh Fedora CoreOS node. (see issue template text).

travier · 2022-12-12T16:47:22Z

Same for the second question, check the issue template text

travier · 2022-12-12T16:48:54Z

See also #461

c4rt0 · 2023-01-26T18:31:08Z

Updated comment regarding rpm-ostree output in the first question.

travier · 2023-01-27T10:23:00Z

For the second question, you should to give us the info for each package listed in the answer to the first question.

travier · 2023-01-27T11:05:14Z

Next steps (can be done in parallel):

Make a PR adding audit to fedora-coreos-config
~~Make a PR for https://bugzilla.redhat.com/show_bug.cgi?id=1827263~~ WONTFIX

c4rt0 · 2023-01-27T11:30:17Z

Updated comment referring to size of the initscripts package

travier · 2023-01-27T11:38:44Z

Hum, we need the info for the initscripts-service package, not the initscripts one 🙂.

c4rt0 · 2023-01-27T11:44:53Z

Of course - updated 😶‍🌫️

jlebon · 2023-01-27T16:05:50Z

IMO, I don't think we should add initscripts-service to FCOS as is. It brings back /usr/sbin/service which is a legacy API. We discussed in the meeting maybe doing something in postprocessing as a last resort, but ideally we come to an agreement at the packaging level to e.g. lower it to a weak dep maybe and shipping auditd-{condrestart,reload,restart,resume,rotate,state,stop} scripts instead (those are the supported service actions that rely on direct signaling).

See: coreos/fedora-coreos-tracker#1362

travier · 2023-01-30T11:34:07Z

Looking at https://bugzilla.redhat.com/show_bug.cgi?id=1827263 and the auditd.service unit again (https://github.com/linux-audit/audit-userspace/blob/master/init.d/auditd.service), it's not clear to me that we should remove either auditctl or augenrules.

travier · 2023-01-30T11:34:41Z

Context for service binary removal:

https://bugzilla.redhat.com/show_bug.cgi?id=1768815

travier · 2023-01-30T11:46:25Z

The audit package already includes the following scripts (https://github.com/linux-audit/audit-userspace/tree/master/init.d):

$ rpm -ql audit-3.0.9-1.fc37.x86_64 | grep legacy
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop

travier · 2023-01-30T12:05:40Z

Option A: The short option is thus just to remove the service binary and man page in a post-script.
Option B: The long option is to rewrite those as a proper standalone script that is not correlated to the service binary.
Option C: Another option is to move the service binary somewhere else and include a wrapper script that only accepts auditd as an option for calls to service auditd <stop|restart|...> and rejects everything else.

travier · 2023-01-30T12:07:37Z

Flagging for meeting discussion but I won't be here this week so maybe next week.

c4rt0 · 2023-02-14T11:06:44Z

Since I was on a course last week, I wonder if there were any debate related to this topic?

travier · 2023-02-14T11:46:52Z

Not yet. There will likely be this week.

travier · 2023-02-14T11:47:45Z

You can check the meeting logs (see the README in this repo) for each meeting.

travier · 2023-02-15T16:50:01Z

Links to existing docs about the service interface for audit:

travier · 2023-02-15T17:03:14Z

Past discussion: https://bugzilla.redhat.com/show_bug.cgi?id=1768815

travier · 2023-02-15T17:05:53Z

We'll have to reach out to the audit maintainers to see which path they would prefer to ideally implement option B.

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

See: coreos/fedora-coreos-tracker#1362 See: linux-audit/audit-userspace@39802bf

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

travier · 2023-09-12T09:12:20Z

Note for when we enable next-devel: we'll have to confirm that initscripts-service is not pulled-in.

We want to make sure we never unknowingly start shipping this package. Relevant with the recent addition of audit which used to pull it in: coreos/fedora-coreos-tracker#1362

jlebon · 2023-09-12T13:36:52Z

Note for when we enable next-devel: we 'll have to confirm that initscripts-service is not pulled-in.

Opened coreos/fedora-coreos-config#2591 which will guarantee this. :)

We want to make sure we never unknowingly start shipping this package. Relevant with the recent addition of audit which used to pull it in: coreos/fedora-coreos-tracker#1362

See: coreos/fedora-coreos-tracker#1362 See: linux-audit/audit-userspace@39802bf

dustymabe · 2023-09-20T19:07:30Z

The fix for this went into next stream release 39.20230916.1.1. Please try out the new release and report issues.

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

We want to make sure we never unknowingly start shipping this package. Relevant with the recent addition of audit which used to pull it in: coreos/fedora-coreos-tracker#1362

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

We want to make sure we never unknowingly start shipping this package. Relevant with the recent addition of audit which used to pull it in: coreos/fedora-coreos-tracker#1362

dustymabe · 2023-11-07T21:45:34Z

The fix for this went into testing stream release 39.20231101.2.0. Please try out the new release and report issues.

See: coreos/fedora-coreos-tracker#1362

dustymabe · 2023-11-21T14:46:29Z

The fix for this went into stable stream release 39.20231101.3.0.

c4rt0 added the kind/enhancement label Dec 12, 2022

travier assigned c4rt0 Dec 12, 2022

travier added the jira for syncing to jira label Dec 12, 2022

c4rt0 added a commit to c4rt0/fedora-coreos-config that referenced this issue Jan 30, 2023

manifests/system-configuration: Add audit

6a776f3

See: coreos/fedora-coreos-tracker#1362

c4rt0 mentioned this issue Jan 30, 2023

manifests/system-configuration: Add audit coreos/fedora-coreos-config#2205

Closed

travier mentioned this issue Jan 30, 2023

including audit in Fedora CoreOS #461

Closed

travier added status/decided status/pending-action Needs action meeting topics for meetings labels Jan 30, 2023

travier added a commit to travier/fedora-coreos-config that referenced this issue Sep 11, 2023

manifests/system-configuration: Add audit

97ce832

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

travier added a commit to travier/fedora-coreos-config that referenced this issue Sep 11, 2023

manifests/system-configuration: Add audit

643cdee

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

travier added a commit to travier/fedora-coreos-docs that referenced this issue Sep 11, 2023

Add 'Managing the audit daemon' page

440946c

See: coreos/fedora-coreos-tracker#1362 See: linux-audit/audit-userspace@39802bf

dustymabe closed this as completed in coreos/fedora-coreos-config#2590 Sep 11, 2023

dustymabe pushed a commit to coreos/fedora-coreos-config that referenced this issue Sep 11, 2023

manifests/system-configuration: Add audit

f28732e

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

dustymabe added status/pending-next-release Fixed upstream. Waiting on a next release. F39 and removed status/decided labels Sep 12, 2023

jlebon mentioned this issue Sep 12, 2023

manifests/fedora-coreos: ban initscripts-service coreos/fedora-coreos-config#2591

Merged

dustymabe mentioned this issue Sep 12, 2023

audit messages are flooding the console #220

Closed

travier mentioned this issue Sep 15, 2023

[next-devel] overrides: fast-track audit-3.1.2-4.fc39 coreos/fedora-coreos-config#2603

Merged

dustymabe mentioned this issue Sep 18, 2023

F39: SELinux denials no longer go to the journal #1576

Open

travier added a commit to coreos/fedora-coreos-docs that referenced this issue Sep 20, 2023

Add 'Managing the audit daemon' page

75a82da

See: coreos/fedora-coreos-tracker#1362 See: linux-audit/audit-userspace@39802bf

dustymabe added status/pending-testing-release Fixed upstream. Waiting on a testing release. and removed status/pending-next-release Fixed upstream. Waiting on a next release. labels Sep 20, 2023

HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023

manifests/system-configuration: Add audit

4abc701

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023

manifests/system-configuration: Add audit

a510972

Include audit to be able to manage and load rules in the audit subsystem in the kernel. Fixes: coreos/fedora-coreos-tracker#1362

dustymabe added status/pending-stable-release Fixed upstream and in testing. Waiting on stable release. and removed status/pending-testing-release Fixed upstream. Waiting on a testing release. labels Nov 7, 2023

imguoguo pushed a commit to fedora-riscv/audit that referenced this issue Nov 11, 2023

audit.spec: Replace calls to service with auditctl commands

59da250

See: coreos/fedora-coreos-tracker#1362

dustymabe removed the status/pending-stable-release Fixed upstream and in testing. Waiting on stable release. label Nov 21, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Package Request: audit #1362

New Package Request: audit #1362

c4rt0 commented Dec 12, 2022 •

edited

Loading

travier commented Dec 12, 2022

travier commented Dec 12, 2022

travier commented Dec 12, 2022

c4rt0 commented Jan 26, 2023

travier commented Jan 27, 2023 •

edited

Loading

travier commented Jan 27, 2023 •

edited

Loading

c4rt0 commented Jan 27, 2023 •

edited

Loading

travier commented Jan 27, 2023 •

edited

Loading

c4rt0 commented Jan 27, 2023 •

edited

Loading

jlebon commented Jan 27, 2023

travier commented Jan 30, 2023

travier commented Jan 30, 2023 •

edited

Loading

travier commented Jan 30, 2023

travier commented Jan 30, 2023 •

edited

Loading

travier commented Jan 30, 2023

c4rt0 commented Feb 14, 2023 •

edited

Loading

travier commented Feb 14, 2023

travier commented Feb 14, 2023

travier commented Feb 15, 2023

travier commented Feb 15, 2023

travier commented Feb 15, 2023

travier commented Sep 12, 2023 •

edited

Loading

jlebon commented Sep 12, 2023

dustymabe commented Sep 20, 2023

dustymabe commented Nov 7, 2023

dustymabe commented Nov 21, 2023

New Package Request: audit #1362

New Package Request: audit #1362

Comments

c4rt0 commented Dec 12, 2022 • edited Loading

What, if any, are the additional dependencies on the package? (i.e. does it pull in Python, Perl, etc)

What is the size of the package and its dependencies?

What problem are you trying to solve with this package? Or what functionality does the package provide?

Can the software provided by the package be run from a container? Explain why or why not.

Can the tool(s) provided by the package be helpful in debugging container runtime issues?

Can the tool(s) provided by the package be helpful in debugging networking issues?

Is it possible to layer the package onto the base OS as a day 2 operation? Explain why or why not.

In the case of packages providing services and binaries, can the packaging be adjusted to just deliver binaries?

Can the tool(s) provided by the package be used to do things we’d rather users not be able to do in FCOS?

Does the software provided by the package have a history of CVEs?

travier commented Dec 12, 2022

travier commented Dec 12, 2022

travier commented Dec 12, 2022

c4rt0 commented Jan 26, 2023

travier commented Jan 27, 2023 • edited Loading

travier commented Jan 27, 2023 • edited Loading

c4rt0 commented Jan 27, 2023 • edited Loading

travier commented Jan 27, 2023 • edited Loading

c4rt0 commented Jan 27, 2023 • edited Loading

jlebon commented Jan 27, 2023

travier commented Jan 30, 2023

travier commented Jan 30, 2023 • edited Loading

travier commented Jan 30, 2023

travier commented Jan 30, 2023 • edited Loading

travier commented Jan 30, 2023

c4rt0 commented Feb 14, 2023 • edited Loading

travier commented Feb 14, 2023

travier commented Feb 14, 2023

travier commented Feb 15, 2023

travier commented Feb 15, 2023

travier commented Feb 15, 2023

travier commented Sep 12, 2023 • edited Loading

jlebon commented Sep 12, 2023

dustymabe commented Sep 20, 2023

dustymabe commented Nov 7, 2023

dustymabe commented Nov 21, 2023

c4rt0 commented Dec 12, 2022 •

edited

Loading

travier commented Jan 27, 2023 •

edited

Loading

travier commented Jan 27, 2023 •

edited

Loading

c4rt0 commented Jan 27, 2023 •

edited

Loading

travier commented Jan 27, 2023 •

edited

Loading

c4rt0 commented Jan 27, 2023 •

edited

Loading

travier commented Jan 30, 2023 •

edited

Loading

travier commented Jan 30, 2023 •

edited

Loading

c4rt0 commented Feb 14, 2023 •

edited

Loading

travier commented Sep 12, 2023 •

edited

Loading