Re: Re: "service auditd start" fails inside a container

Re: Re: "service auditd start" fails inside a container

[江杨]

[-- Attachment #1.1: Type: text/plain, Size: 119 bytes --]

May I ask if Auditd supports Docker? Thank you
https://listman.redhat.com/archives/linux-audit/2018-July/msg00078.html

[-- Attachment #1.2: Type: text/html, Size: 244 bytes --]

[-- Attachment #2: Type: text/plain, Size: 107 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: Re: "service auditd start" fails inside a container

[Paul Moore]

On Fri, Apr 28, 2023 at 8:25 AM 江杨 <jiangyang.me@gmail.com> wrote:
>
> May I ask if Auditd supports Docker? Thank you
> https://listman.redhat.com/archives/linux-audit/2018-July/msg00078.html

Have you tried the configuration changes suggested in the mailing list
post you linked above?

-- 
paul-moore.com

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: "service auditd start" fails inside a container

[Steve Grubb]

On Friday, April 28, 2023 3:54:32 AM EDT 江杨 wrote:
> May I ask if Auditd supports Docker? Thank you
> https://listman.redhat.com/archives/linux-audit/2018-July/msg00078.html

There is no active work that I know of to put auditd in a container. It's 
libraries are used by many applications. So, I don't know what use it would 
be to containerize it.

And if you are asking if auditd can audit events in a container, I think that 
answer is also no.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: "service auditd start" fails inside a container

[江杨]

[-- Attachment #1.1: Type: text/plain, Size: 617 bytes --]

Thank you for your information.

Steve Grubb <sgrubb@redhat.com> 于2023年4月29日周六 02:49写道：

> On Friday, April 28, 2023 3:54:32 AM EDT 江杨 wrote:
> > May I ask if Auditd supports Docker? Thank you
> > https://listman.redhat.com/archives/linux-audit/2018-July/msg00078.html
>
> There is no active work that I know of to put auditd in a container. It's
> libraries are used by many applications. So, I don't know what use it
> would
> be to containerize it.
>
> And if you are asking if auditd can audit events in a container, I think
> that
> answer is also no.
>
> -Steve
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 1056 bytes --]

[-- Attachment #2: Type: text/plain, Size: 107 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: "service auditd start" fails inside a container

[Daniel Walsh]

On 4/28/23 14:48, Steve Grubb wrote:
> On Friday, April 28, 2023 3:54:32 AM EDT 江杨 wrote:
>> May I ask if Auditd supports Docker? Thank you
>> https://listman.redhat.com/archives/linux-audit/2018-July/msg00078.html
> There is no active work that I know of to put auditd in a container. It's
> libraries are used by many applications. So, I don't know what use it would
> be to containerize it.
>
> And if you are asking if auditd can audit events in a container, I think that
> answer is also no.
>
> -Steve
>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://listman.redhat.com/mailman/listinfo/linux-audit

I don't believe there is anything to prevent auditd from running within 
a container.  You can turn up and down the container to many different 
levels or security separation. There will be some security things that 
need to be turned off.

Running a contianer privileged will turn off almost everything form a 
security perspective, and then running with some of the namespaces 
shared with the host.

Something like

podman run --privileged --network=host --pid=host ... auditimage

Should work.

Later tightening up the security should also be possible, but you would 
need to know what auditd needs access to.

With all that said, I am not sure what you are trying to achieve by 
containerizing the audit daemon.

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: "service auditd start" fails inside a container

[Richard Guy Briggs]

On 2023-05-01 11:01, Daniel Walsh wrote:
> On 4/28/23 14:48, Steve Grubb wrote:
> > On Friday, April 28, 2023 3:54:32 AM EDT 江杨 wrote:
> > > May I ask if Auditd supports Docker? Thank you
> > > https://listman.redhat.com/archives/linux-audit/2018-July/msg00078.html
> > There is no active work that I know of to put auditd in a container. It's
> > libraries are used by many applications. So, I don't know what use it would
> > be to containerize it.
> > 
> > And if you are asking if auditd can audit events in a container, I think that
> > answer is also no.
> > 
> > -Steve
> 
> I don't believe there is anything to prevent auditd from running within a
> container.  You can turn up and down the container to many different levels
> or security separation. There will be some security things that need to be
> turned off.
> 
> Running a contianer privileged will turn off almost everything form a
> security perspective, and then running with some of the namespaces shared
> with the host.
> 
> Something like
> 
> podman run --privileged --network=host --pid=host ... auditimage
> 
> Should work.
> 
> Later tightening up the security should also be possible, but you would need
> to know what auditd needs access to.
> 
> With all that said, I am not sure what you are trying to achieve by
> containerizing the audit daemon.

Audit currently requires access to the root userspace and pid
namespaces, so if the container shares those with the host, it should
run.

There are work items to address this, but they haven't been started in
ernest yet:
	https://github.com/linux-audit/audit-kernel/issues/93
dependancies:
	https://github.com/linux-audit/audit-kernel/issues/90
	https://github.com/linux-audit/audit-kernel/issues/91
	https://github.com/linux-audit/audit-kernel/issues/92
	https://github.com/linux-audit/audit-kernel/issues/75

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

"service auditd start" fails inside a container

[Venkata Neehar Kurukunda]

[-- Attachment #1: Type: text/html, Size: 2556 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: "service auditd start" fails inside a container

[Steve Grubb]

On Thursday, July 19, 2018 2:16:39 PM EDT Venkata Neehar Kurukunda wrote:
> Hi,
> 
> I am writing this email to report an issue while using audit inside a
> docker container (with CentOS 7.5 as base layer). It installs fine, but,
> when I try to do service auditd start, it fails with the message"
> "Redirecting to /bin/systemctl start auditd.service Job for auditd.service
> failed because the control process exited with error code. See "systemctl
> status auditd.service" and "journalctl -xe" for details."
> 
> The output of the command, systemctl status auditd.service, is:
> "
> ● auditd.service - Security Auditing Service
>    Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor
> preset: enabled) Active: failed (Result: exit-code) since Thu 2018-07-19
> 18:12:50 UTC; 2min 8s ago Docs: man:auditd(8)
>            https://github.com/linux-audit/audit-documentation
>   Process: 12119 ExecStart=/sbin/auditd (code=exited, status=1/FAILURE)
> Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Starting Security Auditing
> Service... Jul 19 18:12:50 wanly1.fyre.ibm.com auditd[12120]: Started
> dispatcher: /sbin/audispd pid: 12122 Jul 19 18:12:50 wanly1.fyre.ibm.com
> auditd[12120]: Error sending status request (Operation not permitted) Jul
> 19 18:12:50 wanly1.fyre.ibm.com auditd[12120]: Error sending enable
> request (Operation not permitted) Jul 19 18:12:50 wanly1.fyre.ibm.com
> systemd[1]: auditd.service: control process exited, code=exited status=1
> Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Failed to start Security
> Auditing Service. Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Unit
> auditd.service entered failed state. Jul 19 18:12:50 wanly1.fyre.ibm.com
> systemd[1]: auditd.service failed."
> 
> Can someone please help me figure this issue out.

At the moment, auditd can be used inside a container only for aggregating 
logs from other systems. It cannot be used to get events relevant to the 
cotainer or the host OS. If you want to aggregate only, then set 
local_events=no in auditd.conf.

Container support is still under development.

-Steve




--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit