sysusers: emit audit events for user and group creation (#35957)
Background: Fedora/RHEL are switching to sysusers.d metadata for creation of users and groups for system users defined by packages (https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers). Packages carry sysusers files. During package installation, rpm calls an program to execute on this config. This program may either be /usr/lib/rpm/sysusers.sh which calls useradd/groupadd, or /usr/bin/systemd-sysusers. To match the functionality provided by useradd/groupadd from the shadow-utils project, systemd-sysusers must emit audit events so that it provides a drop-in replacement. systemd-sysuers will emit audit events AUDIT_ADD_USER/AUDIT_ADD_GROUP when adding users and groups. The operation "names" are copied from shadow-utils, so the format of the events that is generated on success should be identical. On failure, things are more complicated. We write the whole file at once, once, so we first generate "success" messages for each entry, then we try to write the files, and if things fail, we generate failure messages to all entries that we failed to write.
This commit is contained in:
+2
-2
@@ -3560,7 +3560,7 @@ void manager_send_unit_audit(Manager *m, Unit *u, int type, bool success) {
|
||||
if (MANAGER_IS_RELOADING(m))
|
||||
return;
|
||||
|
||||
audit_fd = get_audit_fd();
|
||||
audit_fd = get_core_audit_fd();
|
||||
if (audit_fd < 0)
|
||||
return;
|
||||
|
||||
@@ -3575,7 +3575,7 @@ void manager_send_unit_audit(Manager *m, Unit *u, int type, bool success) {
|
||||
if (ERRNO_IS_PRIVILEGE(errno)) {
|
||||
/* We aren't allowed to send audit messages? Then let's not retry again. */
|
||||
log_debug_errno(errno, "Failed to send audit message, closing audit socket: %m");
|
||||
close_audit_fd();
|
||||
close_core_audit_fd();
|
||||
} else
|
||||
log_warning_errno(errno, "Failed to send audit message, ignoring: %m");
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user