Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Turn off audit instead of using a custom binary to trap output #4358

Merged

Conversation

VladimirSlavik
Copy link
Contributor

@VladimirSlavik VladimirSlavik commented Oct 3, 2022

This runs auditctl -e 0 instead of our custom binary that eats audit messages.

Depends on weldr/lorax#1271


Previously:

  • clean up most things audit in lorax templates
  • install a custom replacement for auditd from the anaconda packages, again in templates
  • run the replacement manually in anaconda

Now:

  • keep audit things in templates as they are
  • do not install the custom replacement binary in templates
  • in anaconda, run auditctl -e 0 instead of the custom binary

Overall goals remain the same and met:

  • keep boot.iso small: this adds +200 KiB-ish
  • do not run auditd to lower runtime memory requirements: still ok
  • do not spam journal/syslog with audit messages: still ok

Note: Most audit messages come from dracut, where it is not turned off anyway.


Note 2: To have no audit messages, boot with audit=0

@VladimirSlavik
Copy link
Contributor Author

VladimirSlavik commented Oct 3, 2022

/kickstart-test --testtype smoke

edit: Ah, yes, dropping the binary invalidates lorax templates, so kickstart tests won't even start until the lorax PR is merged.

@VladimirSlavik VladimirSlavik added the blocked Don't merge this pull request! label Oct 3, 2022
Copy link
Contributor

@poncovka poncovka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

Copy link
Contributor

@M4rtinK M4rtinK left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me - nice cleanup! :)

Copy link
Member

@jkonecny12 jkonecny12 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great improvement!

@VladimirSlavik
Copy link
Contributor Author

Hi Brian @bcl, could you please make another rawhide lorax release? The changes are merged but not released yet, so this is blocked...

@VladimirSlavik
Copy link
Contributor Author

New lorax tagged, waiting for the repos... https://koji.fedoraproject.org/koji/buildinfo?buildID=2074269

@VladimirSlavik
Copy link
Contributor Author

/kickstart-test --testtype smoke

@VladimirSlavik VladimirSlavik removed the blocked Don't merge this pull request! label Oct 17, 2022
@VladimirSlavik VladimirSlavik merged commit c88a127 into rhinstaller:master Oct 17, 2022
@VladimirSlavik VladimirSlavik deleted the master-audit-turn-off branch October 17, 2022 11:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
f38 Fedora 38
4 participants