From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Bob Beck" Subject: Can auditd run in lxc on centos7 Date: Thu, 5 Apr 2018 12:26:15 -0400 Message-ID: <002a01d3ccfa$d247fda0$76d7f8e0$@assurtech.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3140672886306601622==" Return-path: Received: from mx1.redhat.com (ext-mx02.extmail.prod.ext.phx2.redhat.com [10.5.110.26]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 9628382208 for ; Thu, 5 Apr 2018 16:26:23 +0000 (UTC) Received: from Encrypt.Assurtech.com (encrypt.assurtech.com [50.200.191.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 30A707E9D2 for ; Thu, 5 Apr 2018 16:26:22 +0000 (UTC) Received: from Encrypt.Assurtech.com (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 3D1A31FB2202_AC64E2DB for ; Thu, 5 Apr 2018 16:26:21 +0000 (GMT) Received: from Assurtech.com (unknown [192.168.2.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "Assurtech.com", Issuer "Symantec Class 3 Secure Server CA - G4" (verified OK)) by Encrypt.Assurtech.com (Sophos Email Appliance) with ESMTPS id B5CE31FAF4BE_AC64E2CF for ; Thu, 5 Apr 2018 16:26:20 +0000 (GMT) Content-Language: en-us List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multipart message in MIME format. --===============3140672886306601622== Content-Type: multipart/alternative; boundary="----=_NextPart_000_002B_01D3CCD9.4B374800" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_002B_01D3CCD9.4B374800 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, I am attempting to run auditd in centos7 inside a lxc container. Here is the log I get when I run auditd -f onfig file /etc/audit/auditd.conf opened for parsing log_file_parser called with: /var/log/audit.log log_format_parser called with: RAW log_group_parser called with: root priority_boost_parser called with: 4 flush_parser called with: INCREMENTAL freq_parser called with: 20 num_logs_parser called with: 5 qos_parser called with: lossy dispatch_parser called with: /usr/sbin/audispd name_format_parser called with: NONE max_log_size_parser called with: 6 max_log_size_action_parser called with: ROTATE space_left_parser called with: 75 space_action_parser called with: SYSLOG action_mail_acct_parser called with: root admin_space_left_parser called with: 50 admin_space_left_action_parser called with: SUSPEND disk_full_action_parser called with: SUSPEND disk_error_action_parser called with: SUSPEND tcp_listen_queue_parser called with: 5 tcp_max_per_addr_parser called with: 1 tcp_client_max_idle_parser called with: 0 enable_krb5_parser called with: no GSSAPI support is not enabled, ignoring value at line 30 krb5_principal_parser called with: auditd GSSAPI support is not enabled, ignoring value at line 31 Started dispatcher: /usr/sbin/audispd pid: 3028 type=DAEMON_START msg=audit(1522944040.042:592): op=start ver=2.8.4 format=raw kernel=3.10.0-693.17.1.el7.centos.plus.i686 auid=4294967295 pid=3026 uid=0 ses=4294967295 subj=system_u:system_r:init_t res=success config_manager init complete Error sending status request (Connection refused) Error sending enable request (Connection refused) type=DAEMON_ABORT msg=audit(1522944040.043:593): op=set-enable auid=4294967295 pid=3026 uid=0 ses=4294967295 subj=system_u:system_r:init_t res=failed Unable to set initial audit startup state to 'enable', exiting The audit daemon is exiting. Error setting audit daemon pid (Connection refused) ------=_NextPart_000_002B_01D3CCD9.4B374800 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

I am = attempting to run auditd in centos7 inside a lxc = container.

 

Here is the log I get when I run auditd = –f

 

onfig file /etc/audit/auditd.conf opened for = parsing

log_file_parser called with: = /var/log/audit.log

log_format_parser = called with: RAW

log_group_parser = called with: root

priority_boost_parser called with: 4

flush_parser called with: INCREMENTAL

freq_parser called with: 20

num_logs_parser called with: 5

qos_parser called with: lossy

dispatch_parser called with: = /usr/sbin/audispd

name_format_parser = called with: NONE

max_log_size_parser = called with: 6

max_log_size_action_parser called with: = ROTATE

space_left_parser called with: = 75

space_action_parser called with: = SYSLOG

action_mail_acct_parser called = with: root

admin_space_left_parser = called with: 50

admin_space_left_action_parser called with: = SUSPEND

disk_full_action_parser = called with: SUSPEND

disk_error_action_parser called with: = SUSPEND

tcp_listen_queue_parser = called with: 5

tcp_max_per_addr_parser called with: = 1

tcp_client_max_idle_parser called = with: 0

enable_krb5_parser called = with: no

GSSAPI support is not = enabled, ignoring value at line 30

krb5_principal_parser called with: = auditd

GSSAPI support is not enabled, = ignoring value at line 31

Started = dispatcher: /usr/sbin/audispd pid: 3028

type=3DDAEMON_START msg=3Daudit(1522944040.042:592): = op=3Dstart ver=3D2.8.4 format=3Draw = kernel=3D3.10.0-693.17.1.el7.centos.plus.i686 auid=3D4294967295 = pid=3D3026 uid=3D0 ses=3D4294967295 subj=3Dsystem_u:system_r:init_t = res=3Dsuccess

config_manager init = complete

Error sending status request = (Connection refused)

Error sending = enable request (Connection refused)

type=3DDAEMON_ABORT msg=3Daudit(1522944040.043:593): = op=3Dset-enable auid=3D4294967295 pid=3D3026 uid=3D0 ses=3D4294967295 = subj=3Dsystem_u:system_r:init_t res=3Dfailed

Unable to set initial audit startup state to 'enable', = exiting

The audit daemon is = exiting.

Error setting audit daemon = pid (Connection refused)

------=_NextPart_000_002B_01D3CCD9.4B374800-- --===============3140672886306601622== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3140672886306601622==--