Skip to content

v1.0.11

Choose a tag to compare

View all tags
@doccaz doccaz released this 05 Jun 14:43
v1.0.11
8735f99
This commit was signed with the committer’s verified signature.
doccaz Erico Mendonca
GPG key ID: 5E78322C729D0240
Verified
Learn about vigilant mode.

v1.0.11 — Fix auditd/audit-rules.service immutable-flag loop

Root cause

The zz-pci-immutable.rules fragment sets -e 2 (immutable mode) after the first successful highstate. On subsequent systemctl start audit-rules.service calls (e.g. when Salt tries to start auditd), augenrules --load calls auditctl -R which hits «Rule exists» because:

  1. auditctl -D silently exits 0 but does nothing (rules are locked)
  2. Existing kernel rules can't be replaced without a reboot

Fix

Install a systemd drop-in at /etc/systemd/system/audit-rules.service.d/pci-immutable.conf that wraps augenrules with an immutability check:

[Service]
ExecStart=
ExecStart=/bin/sh -c 'if auditctl -s 2>/dev/null | grep -q "enabled 2"; then echo "Audit rules immutable (-e 2), skipping reload"; exit 0; fi; /sbin/augenrules --load'

When audit rules are immutable (already correctly loaded from the previous boot run), the wrapper exits 0 so audit-rules.service succeeds and auditd can start.

Included from v1.0.10

  • Formula UI: each category label shows its PCI-DSS requirement refs inline
  • metadata.yml: name: field fixes «Pci Dss» → «PCI-DSS v4 Hardening» tab label
  • Master-switch $help tooltip explains the enable toggle
Assets 3
Loading