unit: don't encode literally which unit types to generate audit events for

Let's abstract this a bit, and keep this info purely in UnitVTable.
This commit is contained in:
Lennart Poettering
2023-06-30 22:01:02 +02:00
parent 506c1bb594
commit d52b8493c2
4 changed files with 20 additions and 16 deletions
+6 -9
View File
@@ -3350,23 +3350,20 @@ void manager_send_unit_audit(Manager *m, Unit *u, int type, bool success) {
if (MANAGER_IS_RELOADING(m))
return;
if (u->type != UNIT_SERVICE)
return;
r = unit_name_to_prefix_and_instance(u->id, &p);
if (r < 0) {
log_error_errno(r, "Failed to extract prefix and instance of unit name: %m");
log_warning_errno(r, "Failed to extract prefix and instance of unit name, ignoring: %m");
return;
}
msg = strjoina("unit=", p);
if (audit_log_user_comm_message(audit_fd, type, msg, "systemd", NULL, NULL, NULL, success) < 0) {
if (errno == EPERM)
/* We aren't allowed to send audit messages?
* Then let's not retry again. */
if (ERRNO_IS_PRIVILEGE(errno)) {
/* We aren't allowed to send audit messages? Then let's not retry again. */
log_debug_errno(errno, "Failed to send audit message, closing audit socket: %m");
close_audit_fd();
else
log_warning_errno(errno, "Failed to send audit message: %m");
} else
log_warning_errno(errno, "Failed to send audit message, ignoring: %m");
}
#endif
+4
View File
@@ -28,6 +28,7 @@
#include "load-fragment.h"
#include "log.h"
#include "manager.h"
#include "missing_audit.h"
#include "open-file.h"
#include "parse-util.h"
#include "path-util.h"
@@ -5166,4 +5167,7 @@ const UnitVTable service_vtable = {
},
.can_start = service_can_start,
.audit_start_message_type = AUDIT_SERVICE_START,
.audit_stop_message_type = AUDIT_SERVICE_STOP,
};
+6 -7
View File
@@ -39,7 +39,6 @@
#include "log.h"
#include "logarithm.h"
#include "macro.h"
#include "missing_audit.h"
#include "mkdir-label.h"
#include "path-util.h"
#include "process-util.h"
@@ -2585,30 +2584,30 @@ static void unit_update_on_console(Unit *u) {
static void unit_emit_audit_start(Unit *u) {
assert(u);
if (u->type != UNIT_SERVICE)
if (UNIT_VTABLE(u)->audit_start_message_type <= 0)
return;
/* Write audit record if we have just finished starting up */
manager_send_unit_audit(u->manager, u, AUDIT_SERVICE_START, true);
manager_send_unit_audit(u->manager, u, UNIT_VTABLE(u)->audit_start_message_type, /* success= */ true);
u->in_audit = true;
}
static void unit_emit_audit_stop(Unit *u, UnitActiveState state) {
assert(u);
if (u->type != UNIT_SERVICE)
if (UNIT_VTABLE(u)->audit_start_message_type <= 0)
return;
if (u->in_audit) {
/* Write audit record if we have just finished shutting down */
manager_send_unit_audit(u->manager, u, AUDIT_SERVICE_STOP, state == UNIT_INACTIVE);
manager_send_unit_audit(u->manager, u, UNIT_VTABLE(u)->audit_stop_message_type, /* success= */ state == UNIT_INACTIVE);
u->in_audit = false;
} else {
/* Hmm, if there was no start record written write it now, so that we always have a nice pair */
manager_send_unit_audit(u->manager, u, AUDIT_SERVICE_START, state == UNIT_INACTIVE);
manager_send_unit_audit(u->manager, u, UNIT_VTABLE(u)->audit_start_message_type, /* success= */ state == UNIT_INACTIVE);
if (state == UNIT_INACTIVE)
manager_send_unit_audit(u->manager, u, AUDIT_SERVICE_STOP, true);
manager_send_unit_audit(u->manager, u, UNIT_VTABLE(u)->audit_stop_message_type, /* success= */ true);
}
}
+4
View File
@@ -782,6 +782,10 @@ typedef struct UnitVTable {
/* True if systemd-oomd can monitor and act on this unit's recursive children's cgroups */
bool can_set_managed_oom;
/* The audit events to generate on start + stop (or 0 if none shall be generated) */
int audit_start_message_type;
int audit_stop_message_type;
} UnitVTable;
extern const UnitVTable * const unit_vtable[_UNIT_TYPE_MAX];