mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-06-09 19:13:26 +03:00
75 lines
2.8 KiB
Nix
75 lines
2.8 KiB
Nix
{ pkgs, ... }:
|
|
|
|
{
|
|
name = "systemd-journal";
|
|
meta = with pkgs.lib.maintainers; {
|
|
maintainers = [ lewo ];
|
|
};
|
|
|
|
nodes.machine = {
|
|
environment.systemPackages = [ pkgs.audit ];
|
|
};
|
|
nodes.auditd = {
|
|
security.auditd.enable = true;
|
|
security.audit.enable = true;
|
|
environment.systemPackages = [ pkgs.audit ];
|
|
boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
|
|
boot.kernelParams = [ "audit_backlog_limit=8192" ];
|
|
};
|
|
nodes.journaldAudit = {
|
|
services.journald.audit = true;
|
|
security.audit.enable = true;
|
|
environment.systemPackages = [ pkgs.audit ];
|
|
boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
|
|
boot.kernelParams = [ "audit_backlog_limit=8192" ];
|
|
};
|
|
nodes.containerCheck = {
|
|
containers.c1 = {
|
|
autoStart = true;
|
|
config = { };
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.succeed("journalctl --grep=systemd")
|
|
|
|
with subtest("no audit messages"):
|
|
machine.fail("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
|
|
machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
|
|
|
|
with subtest("auditd enabled"):
|
|
auditd.wait_for_unit("multi-user.target")
|
|
|
|
# logs should end up in the journald
|
|
auditd.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
|
|
# logs should end up in the auditd audit log
|
|
auditd.succeed("grep 'unit=systemd-journald' /var/log/audit/audit.log")
|
|
# logs should not end up in kmesg
|
|
machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
|
|
|
|
|
|
with subtest("journald audit"):
|
|
journaldAudit.wait_for_unit("multi-user.target")
|
|
|
|
# logs should end up in the journald
|
|
journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
|
|
# logs should NOT end up in audit log
|
|
journaldAudit.fail("grep 'unit=systemd-journald' /var/log/audit/audit.log")
|
|
# FIXME: If systemd fixes #15324 this test will start failing.
|
|
# You can fix this text by removing the below line.
|
|
# logs ideally should NOT end up in kmesg, but they do due to
|
|
# https://github.com/systemd/systemd/issues/15324
|
|
journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
|
|
|
|
|
|
with subtest("container systemd-journald-audit not running"):
|
|
containerCheck.wait_for_unit("multi-user.target");
|
|
containerCheck.wait_until_succeeds("systemctl -M c1 is-active default.target");
|
|
|
|
# systemd-journald-audit.socket should exist but not run due to the upstream unit's `Condition*` settings
|
|
(status, output) = containerCheck.execute("systemctl -M c1 is-active systemd-journald-audit.socket")
|
|
containerCheck.log(output)
|
|
assert status == 3 and output == "inactive\n", f"systemd-journald-audit.socket should exist in a container but remain inactive, was {output}"
|
|
'';
|
|
}
|