From 13b10627307dcd9f5fee0a54a9d571132f1effa1 Mon Sep 17 00:00:00 2001 From: Arian van Putten Date: Wed, 5 Feb 2025 15:11:59 +0100 Subject: [PATCH 1/3] services/journald: re-enable systemd-journald-audit.socket This was broken due to https://github.com/systemd/systemd/pull/25687 but we never noticed. --- nixos/modules/system/boot/systemd/journald.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix index bfcacc4fa8eb..c72e2c5ed1c1 100644 --- a/nixos/modules/system/boot/systemd/journald.nix +++ b/nixos/modules/system/boot/systemd/journald.nix @@ -116,6 +116,8 @@ in "syslog.socket" ]; + systemd.sockets.systemd-journald-audit.wantedBy = [ "systemd-journald.service" "sockets.target" ]; + environment.etc = { "systemd/journald.conf".text = '' [Journal] From ff78e34e0b63972761db8a5b02a357d6ac5494d3 Mon Sep 17 00:00:00 2001 From: Arian van Putten Date: Wed, 5 Feb 2025 15:19:25 +0100 Subject: [PATCH 2/3] services/journald: introduce audit option We default this option to null ; which is different from upstream which defaults this to true. Defaulting this to true leads to log-spam in /dev/kmesg and thus in our opinion is a bad default https://github.com/systemd/systemd/issues/15324 --- .../modules/system/boot/systemd/journald.nix | 24 ++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix index c72e2c5ed1c1..97b72a6c97f5 100644 --- a/nixos/modules/system/boot/systemd/journald.nix +++ b/nixos/modules/system/boot/systemd/journald.nix @@ -2,6 +2,7 @@ config, lib, pkgs, + utils, ... }: let @@ -78,6 +79,23 @@ in ''; }; + services.journald.audit = lib.mkOption { + default = null; + type = lib.types.nullOr lib.types.bool; + description = '' + If enabled systemd-journald will turn on auditing on start-up. + If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged. + + NixOS defaults to leaving this unset as enabling audit without auditd running leads to spamming /dev/kmesg with random messages + and if you enable auditd then auditd is responsible for turning auditing on. + + If you want to have audit logs in journald and do not mind audit logs also ending up in /dev/kmesg you can set this option to true. + + If you want to for some ununderstandable reason disable auditing if auditd enabled it then you can set this option to false. + It is of NixOS' opinion that setting this to false is definitely the wrong thing to do - but it's an option. + ''; + }; + services.journald.extraConfig = lib.mkOption { default = ""; type = lib.types.lines; @@ -116,7 +134,10 @@ in "syslog.socket" ]; - systemd.sockets.systemd-journald-audit.wantedBy = [ "systemd-journald.service" "sockets.target" ]; + systemd.sockets.systemd-journald-audit.wantedBy = [ + "systemd-journald.service" + "sockets.target" + ]; environment.etc = { "systemd/journald.conf".text = '' @@ -131,6 +152,7 @@ in ${lib.optionalString (cfg.forwardToSyslog) '' ForwardToSyslog=yes ''} + Audit=${utils.systemdUtils.lib.toOption cfg.audit} ${cfg.extraConfig} ''; }; From bf3a70020c624e8f4aec631c4a22f58666b735e1 Mon Sep 17 00:00:00 2001 From: Arian van Putten Date: Fri, 7 Feb 2025 14:10:48 +0100 Subject: [PATCH 3/3] nixos/tests/systemd-journal: test audit behaviour This also tests the presence of an upstream bug --- nixos/tests/systemd-journal.nix | 41 +++++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-) diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix index a0c2f7ee19bb..63ae58970e84 100644 --- a/nixos/tests/systemd-journal.nix +++ b/nixos/tests/systemd-journal.nix @@ -7,12 +7,49 @@ import ./make-test-python.nix ( maintainers = [ lewo ]; }; - nodes.machine = { }; + nodes.machine = { + environment.systemPackages = [ pkgs.audit ]; + }; + nodes.auditd = { + security.auditd.enable = true; + environment.systemPackages = [ pkgs.audit ]; + }; + nodes.journaldAudit = { + services.journald.audit = true; + environment.systemPackages = [ pkgs.audit ]; + }; testScript = '' machine.wait_for_unit("multi-user.target") - machine.succeed("journalctl --grep=systemd") + + with subtest("no audit messages"): + machine.fail("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'") + machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'") + + with subtest("auditd enabled"): + auditd.wait_for_unit("multi-user.target") + + # logs should end up in the journald + auditd.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'") + # logs should end up in the auditd audit log + auditd.succeed("grep 'unit=systemd-journald' /var/log/audit/audit.log") + # logs should not end up in kmesg + machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'") + + + with subtest("journald audit"): + journaldAudit.wait_for_unit("multi-user.target") + + # logs should end up in the journald + journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'") + # logs should NOT end up in audit log + journaldAudit.fail("grep 'unit=systemd-journald' /var/log/audit/audit.log") + # FIXME: If systemd fixes #15324 this test will start failing. + # You can fix this text by removing the below line. + # logs ideally should NOT end up in kmesg, but they do due to + # https://github.com/systemd/systemd/issues/15324 + journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'") ''; } )