diff mbox series

[bug#54309] services: auditd: use exclusive log directory for auditd

Message ID 8b52d7e5-314d-406e-87b7-cdc087dc7826@gmail.com
State New
Headers show
Series [bug#54309] services: auditd: use exclusive log directory for auditd | expand

Checks

Context Check Description
cbaines/applying patch fail View Laminar job
cbaines/issue success View issue

Commit Message

fesoj000 March 10, 2022, 4:29 p.m. UTC 
Use /var/log/audit for auditd. This is the upstream default.

Further, rework the config file generated by auditd-service-type. Only
write values which diverge from the upstream default.

* gnu/services/auditd.scm: add auditd-activation function and extend
activation-service-type.
---
  gnu/services/auditd.scm | 20 +++++++++++++++-----
  1 file changed, 15 insertions(+), 5 deletions(-)
diff mbox series

Patch

diff --git a/gnu/services/auditd.scm b/gnu/services/auditd.scm
index abde811f51..1eb0ed291b 100644
--- a/gnu/services/auditd.scm
+++ b/gnu/services/auditd.scm
@@ -31,10 +31,10 @@  (define-module (gnu services auditd)
              %default-auditd-configuration-directory))
  
  (define auditd.conf
-  (plain-file "auditd.conf" "log_file = /var/log/audit.log\nlog_format = \
-ENRICHED\nfreq = 1\nspace_left = 5%\nspace_left_action = \
-syslog\nadmin_space_left_action = ignore\ndisk_full_action = \
-ignore\ndisk_error_action = syslog\n"))
+  (plain-file "auditd.conf" "\
+space_left = 5%
+space_left_action = syslog
+"))
  
  (define %default-auditd-configuration-directory
    (computed-file "auditd"
@@ -50,6 +50,14 @@  (define-record-type* <auditd-configuration>
                             (default audit))
    (configuration-directory auditd-configuration-configuration-directory))      ; file-like
  
+(define (auditd-activation config)
+  (with-imported-modules '((guix build utils))
+    #~(begin
+        (use-modules (guix build utils))
+        (let ((var-log-audit "/var/log/audit"))
+          (mkdir-p var-log-audit)
+          (chmod var-log-audit #o700)))))
+
  (define (auditd-shepherd-service config)
    (let* ((audit (auditd-configuration-audit config))
           (configuration-directory (auditd-configuration-configuration-directory config)))
@@ -67,7 +75,9 @@  (define auditd-service-type
                  (extensions
                   (list
                    (service-extension shepherd-root-service-type
-                                     auditd-shepherd-service)))
+                                     auditd-shepherd-service)
+                  (service-extension activation-service-type
+                                     auditd-activation)))
                  (default-value
                    (auditd-configuration
                     (configuration-directory %default-auditd-configuration-directory)))))