diff --git a/nixos/modules/security/audit.nix b/nixos/modules/security/audit.nix index f50c465fde5b..849ff57c662c 100644 --- a/nixos/modules/security/audit.nix +++ b/nixos/modules/security/audit.nix @@ -95,7 +95,10 @@ in environment.systemPackages = [ pkgs.audit ]; - systemd.services.audit-rules = { + # upstream contains a audit-rules.service, which uses augenrules. + # That script does not handle cleanup correctly and insists on loading from /etc/audit. + # So, instead we have our own service for loading rules. + systemd.services.audit-rules-nixos = { description = "Load Audit Rules"; wantedBy = [ "sysinit.target" ]; before = [ diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix index 036ce9c01cae..49a99ea30354 100644 --- a/nixos/modules/security/auditd.nix +++ b/nixos/modules/security/auditd.nix @@ -229,7 +229,7 @@ in path = lib.getExe' pkgs.audit "audisp-af_unix"; args = [ "0640" - "/var/run/audispd_events" + "/run/audit/audispd_events" "string" ]; format = "binary"; @@ -256,41 +256,23 @@ in }; }; - systemd.services.auditd = { - description = "Security Audit Logging Service"; - documentation = [ "man:auditd(8)" ]; - wantedBy = [ "sysinit.target" ]; - after = [ - "local-fs.target" - "systemd-tmpfiles-setup.service" - ]; - before = [ - "sysinit.target" - "shutdown.target" - ]; - conflicts = [ "shutdown.target" ]; + systemd.tmpfiles.packages = [ pkgs.audit.out ]; + systemd.packages = [ pkgs.audit.out ]; - unitConfig = { - DefaultDependencies = false; - RefuseManualStop = true; - ConditionVirtualization = "!container"; - ConditionKernelCommandLine = [ - "!audit=0" - "!audit=off" - ]; - }; + # will try to look in /etc for rules to load, which we don't set up + systemd.services.audit-rules.enable = lib.mkDefault false; + + systemd.services.auditd = { + wantedBy = [ "multi-user.target" ]; serviceConfig = { LogsDirectory = "audit"; - ExecStart = "${pkgs.audit}/bin/auditd -l -n -s nochange"; - Restart = "on-failure"; - # Do not restart for intentional exits. See EXIT CODES section in auditd(8). - RestartPreventExitStatus = "2 4 6"; - - # Upstream hardening settings - MemoryDenyWriteExecute = true; - LockPersonality = true; - RestrictRealtime = true; + RuntimeDirectory = "audit"; + ExecStart = [ + # the upstream unit does not allow symlinks, so clear and rewrite the ExecStart + "" + "${lib.getExe' pkgs.audit "auditd"} -l -s nochange" + ]; }; }; }; diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix index 26c015a8107e..d6248bd15fe2 100644 --- a/nixos/modules/services/security/opensnitch.nix +++ b/nixos/modules/services/security/opensnitch.nix @@ -167,6 +167,15 @@ in ''; }; + Audit.AudispSocketPath = lib.mkOption { + type = lib.types.path; + default = "/run/audit/audispd_events"; + description = '' + Configure audit socket path. Used when + `settings.ProcMonitorMethod` is set to `audit`. + ''; + }; + Rules.Path = lib.mkOption { type = lib.types.path; default = "/var/lib/opensnitch/rules"; diff --git a/nixos/tests/audit.nix b/nixos/tests/audit.nix index 0d732442ef4b..d3fc558aeec8 100644 --- a/nixos/tests/audit.nix +++ b/nixos/tests/audit.nix @@ -31,7 +31,7 @@ }; testScript = '' - machine.wait_for_unit("audit-rules.service") + machine.wait_for_unit("audit-rules-nixos.service") machine.wait_for_unit("auditd.service") with subtest("Audit subsystem gets enabled"): @@ -40,14 +40,14 @@ t.assertIn("backlog_limit 512", audit_status) with subtest("unix socket plugin activated"): - machine.succeed("stat /var/run/audispd_events") + machine.succeed("stat /run/audit/audispd_events") with subtest("Custom rule produces audit traces"): machine.succeed("hello") print(machine.succeed("ausearch -k nixos-test -sc exit_group")) - with subtest("Stopping audit-rules.service disables the audit subsystem"): - machine.succeed("systemctl stop audit-rules.service") + with subtest("Stopping audit-rules-nixos.service disables the audit subsystem"): + machine.succeed("systemctl stop audit-rules-nixos.service") t.assertIn("enabled 0", machine.succeed("auditctl -s")) ''; diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index e33b1116c061..617d1f30f6d0 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -7,41 +7,44 @@ bashNonInteractive, buildPackages, linuxHeaders, - python3, + python3Packages, swig, - pkgsCross, libcap_ng, installShellFiles, + makeWrapper, + gawk, + gnugrep, + coreutils, - # Enabling python support while cross compiling would be possible, but the - # configure script tries executing python to gather info instead of relying on - # python3-config exclusively - enablePython ? stdenv.hostPlatform == stdenv.buildPlatform, + enablePython ? !stdenv.hostPlatform.isStatic, + + # passthru nix-update-script, testers, nixosTests, + pkgsStatic ? { }, # CI has allowVariants = false, in which case pkgsMusl would not be passed. So, instead add a default here. + pkgsMusl ? { }, }: stdenv.mkDerivation (finalAttrs: { pname = "audit"; - version = "4.1.1-unstable-2025-08-01"; + version = "4.1.2-unstable-2025-09-06"; # fixes to non-static builds right after 4.1.2 release src = fetchFromGitHub { owner = "linux-audit"; repo = "audit-userspace"; - rev = "bee5984843d0b38992a369825a87a65fb54b18fc"; # musl fixes, --disable-legacy-actions and --runstatedir support - hash = "sha256-l3JHWEHz2xGrYxEvfCUD29W8xm5llUnXwX5hLymRG74="; + rev = "cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4"; + hash = "sha256-NX0TWA+LtcZgbM9aQfokWv2rGNAAb3ksGqAH8URAkYM="; }; postPatch = '' substituteInPlace bindings/swig/src/auditswig.i \ --replace-fail "/usr/include/linux/audit.h" \ "${linuxHeaders}/include/linux/audit.h" + '' + + lib.optionalString (enablePython && finalAttrs.finalPackage.doCheck) '' + patchShebangs auparse/test/auparse_test.py ''; - # https://github.com/linux-audit/audit-userspace/issues/474 - # building databuf_test fails otherwise, as that uses hidden symbols only available in the static builds - dontDisableStatic = true; - outputs = [ "bin" "lib" @@ -59,9 +62,10 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ autoreconfHook installShellFiles + makeWrapper ] ++ lib.optionals enablePython [ - python3 + python3Packages.python # for python3-config swig ]; @@ -87,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: { # capability dropping, currently mostly for plugins as those get spawned as root # see auditd-plugins(5) "--with-libcap-ng=yes" - (if enablePython then "--with-python" else "--without-python") + (lib.withFeature enablePython "python3") ]; __structuredAttrs = true; @@ -98,16 +102,39 @@ stdenv.mkDerivation (finalAttrs: { bashNonInteractive ]; + nativeCheckInputs = lib.optionals enablePython [ + python3Packages.pythonImportsCheckHook + ]; + + pythonImportsCheck = [ "audit" ]; + + doCheck = true; + postInstall = '' installShellCompletion --bash init.d/audit.bash_completion ''; + postFixup = '' + substituteInPlace $bin/bin/augenrules \ + --replace-fail "/sbin/auditctl" "$bin/bin/auditctl" \ + --replace-fail "/bin/ls" "ls" + wrapProgram $bin/bin/augenrules \ + --prefix PATH : ${ + lib.makeBinPath [ + gawk + gnugrep + coreutils + ] + } + ''; + enableParallelBuilding = true; passthru = { updateScript = nix-update-script { }; tests = { - musl = pkgsCross.musl64.audit; + musl = pkgsMusl.audit or null; + static = pkgsStatic.audit or null; pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; audit = nixosTests.audit; }; @@ -116,7 +143,7 @@ stdenv.mkDerivation (finalAttrs: { meta = { homepage = "https://people.redhat.com/sgrubb/audit/"; description = "Audit Library"; - changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.1"; + changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.2"; license = lib.licenses.gpl2Plus; maintainers = with lib.maintainers; [ grimmauld ]; pkgConfigModules = [ diff --git a/pkgs/by-name/op/opensnitch/package.nix b/pkgs/by-name/op/opensnitch/package.nix index dc99acef4777..b682efc1bc1e 100644 --- a/pkgs/by-name/op/opensnitch/package.nix +++ b/pkgs/by-name/op/opensnitch/package.nix @@ -1,6 +1,7 @@ { buildGoModule, fetchFromGitHub, + fetchpatch, protobuf, go-protobuf, pkg-config, @@ -43,6 +44,20 @@ buildGoModule (finalAttrs: { hash = "sha256-XAR7yZjAzbMxIVGSV82agpAGwlejkILGgDI6iRicZuQ="; }; + patches = [ + (fetchpatch { + # https://github.com/evilsocket/opensnitch/pull/1418 + # allow configuring the audit socket path + url = "https://github.com/evilsocket/opensnitch/commit/f9358a464f204068359bf5174e6ff43288f12c7e.patch?full_index=1"; + hash = "sha256-s9CM1CyGpfJZXEtihXCM7nfPhBY8XuwubynTotqtf3E="; + }) + (fetchpatch { + # add missing colon in test definition + url = "https://github.com/evilsocket/opensnitch/commit/4b38ca1260295d2e0f8c4a7313529f83dcca4554.patch?full_index=1"; + hash = "sha256-/z3iFRpcv75FyarVnpK8/PTU2fcFHS+SNbHn7M5Etk8="; + }) + ]; + postPatch = '' # Allow configuring Version at build time substituteInPlace daemon/core/version.go --replace-fail "const " "var " diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 012648099650..df42dcacd05d 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -1134,6 +1134,12 @@ self: super: with self; { audiotools = callPackage ../development/python-modules/audiotools { }; + audit = toPythonModule ( + pkgs.audit.override { + python3Packages = self; + } + ); + auditok = callPackage ../development/python-modules/auditok { }; auditwheel = callPackage ../development/python-modules/auditwheel {