blob: 38b86b82948ce914650d658943a295bb2a6b255e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
{ lib, pkgs, ... }:
{
name = "systemd-journal";
meta = with pkgs.lib.maintainers; {
maintainers = [ lewo ];
};
nodes.machine = {
environment.systemPackages = [ pkgs.audit ];
};
nodes.auditd = {
security.auditd.enable = true;
security.audit.enable = true;
};
nodes.journaldAudit = {
# Verify that the module's option default remains overridable by downstream defaults.
services.journald.settings.Journal.Audit = lib.mkDefault true;
security.audit.enable = true;
};
nodes.containerCheck = {
containers.c1 = {
autoStart = true;
config = {
nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
};
};
};
testScript = ''
machine.wait_for_unit("multi-user.target")
machine.succeed("journalctl --grep=systemd")
with subtest("no audit messages"):
machine.fail("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
with subtest("auditd enabled"):
auditd.wait_for_unit("multi-user.target")
# logs should end up in the journald
auditd.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
# logs should end up in the auditd audit log
auditd.succeed("grep 'unit=systemd-journald' /var/log/audit/audit.log")
# logs should not end up in kmesg
auditd.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
with subtest("journald audit"):
journaldAudit.wait_for_unit("multi-user.target")
journaldAudit.succeed("grep -Fx 'Audit=true' /etc/systemd/journald.conf")
# logs should end up in the journald
journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
# logs should NOT end up in audit log
journaldAudit.fail("grep 'unit=systemd-journald' /var/log/audit/audit.log")
with subtest("container systemd-journald-audit not running"):
containerCheck.wait_for_unit("multi-user.target");
containerCheck.wait_until_succeeds("systemctl -M c1 is-active default.target");
# systemd-journald-audit.socket should exist but not run due to the upstream unit's `Condition*` settings
(status, output) = containerCheck.execute("systemctl -M c1 is-active systemd-journald-audit.socket")
containerCheck.log(output)
assert status == 3 and output == "inactive\n", f"systemd-journald-audit.socket should exist in a container but remain inactive, was {output}"
'';
}
|
