From 75271d60768ebc13cadf0f6d5ad12e1d10181f3d Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 13:21:32 +0200 Subject: [PATCH 01/12] audit: 4.1.1-unstable-2025-08-01 -> 4.1.2-unstable-2025-09-06 Release notes: https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.2 --- pkgs/by-name/au/audit/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index e33b1116c061..300be8438fd9 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -23,13 +23,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "audit"; - version = "4.1.1-unstable-2025-08-01"; + version = "4.1.2-unstable-2025-09-06"; # fixes to non-static builds right after 4.1.2 release src = fetchFromGitHub { owner = "linux-audit"; repo = "audit-userspace"; - rev = "bee5984843d0b38992a369825a87a65fb54b18fc"; # musl fixes, --disable-legacy-actions and --runstatedir support - hash = "sha256-l3JHWEHz2xGrYxEvfCUD29W8xm5llUnXwX5hLymRG74="; + rev = "cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4"; + hash = "sha256-NX0TWA+LtcZgbM9aQfokWv2rGNAAb3ksGqAH8URAkYM="; }; postPatch = '' @@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: { meta = { homepage = "https://people.redhat.com/sgrubb/audit/"; description = "Audit Library"; - changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.1"; + changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.2"; license = lib.licenses.gpl2Plus; maintainers = with lib.maintainers; [ grimmauld ]; pkgConfigModules = [ From ef0f4c0c5f7f16254e0c005b87587f326154f045 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 14:14:43 +0200 Subject: [PATCH 02/12] audit: enable checks --- pkgs/by-name/au/audit/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index 300be8438fd9..6fb35c7340ac 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -36,6 +36,9 @@ stdenv.mkDerivation (finalAttrs: { substituteInPlace bindings/swig/src/auditswig.i \ --replace-fail "/usr/include/linux/audit.h" \ "${linuxHeaders}/include/linux/audit.h" + '' + + lib.optionalString (enablePython && finalAttrs.finalPackage.doCheck) '' + patchShebangs auparse/test/auparse_test.py ''; # https://github.com/linux-audit/audit-userspace/issues/474 @@ -98,6 +101,8 @@ stdenv.mkDerivation (finalAttrs: { bashNonInteractive ]; + doCheck = true; + postInstall = '' installShellCompletion --bash init.d/audit.bash_completion ''; From 7596747f62b44b2b4a651d8e8c4896dd0a198715 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 14:15:01 +0200 Subject: [PATCH 03/12] audit: disable static by default --- pkgs/by-name/au/audit/package.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index 6fb35c7340ac..8a542b78cc8b 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -41,10 +41,6 @@ stdenv.mkDerivation (finalAttrs: { patchShebangs auparse/test/auparse_test.py ''; - # https://github.com/linux-audit/audit-userspace/issues/474 - # building databuf_test fails otherwise, as that uses hidden symbols only available in the static builds - dontDisableStatic = true; - outputs = [ "bin" "lib" From c0e0f97a5dcb60f585f6907ebd247bc2ce99db8e Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 15:53:48 +0200 Subject: [PATCH 04/12] audit: clean up passthru.tests --- pkgs/by-name/au/audit/package.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index 8a542b78cc8b..de2e23f47a5b 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -9,7 +9,6 @@ linuxHeaders, python3, swig, - pkgsCross, libcap_ng, installShellFiles, @@ -17,9 +16,13 @@ # configure script tries executing python to gather info instead of relying on # python3-config exclusively enablePython ? stdenv.hostPlatform == stdenv.buildPlatform, + + # passthru nix-update-script, testers, nixosTests, + pkgsStatic ? { }, # CI has allowVariants = false, in which case pkgsMusl would not be passed. So, instead add a default here. + pkgsMusl ? { }, }: stdenv.mkDerivation (finalAttrs: { pname = "audit"; @@ -108,7 +111,8 @@ stdenv.mkDerivation (finalAttrs: { passthru = { updateScript = nix-update-script { }; tests = { - musl = pkgsCross.musl64.audit; + musl = pkgsMusl.audit or null; + static = pkgsStatic.audit or null; pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; audit = nixosTests.audit; }; From 211b818f9f88ee31fe5b5e5552e15b6282a27864 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 16:30:55 +0200 Subject: [PATCH 05/12] audit: enable python on cross previously, audit would attempt to execute the hostPlatform python to gather extra info, which broke on cross. This was fixed upstream in https://github.com/linux-audit/audit-userspace/commit/8f6095a9fbbd52816a5b40f08c744d4d84cd7984, so the audit python module just works, even on cross. Python support is still disabled on static, because the module wouldn't be importable anyways. --- pkgs/by-name/au/audit/package.nix | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index de2e23f47a5b..4e7fd04acb84 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -7,15 +7,12 @@ bashNonInteractive, buildPackages, linuxHeaders, - python3, + python3Packages, swig, libcap_ng, installShellFiles, - # Enabling python support while cross compiling would be possible, but the - # configure script tries executing python to gather info instead of relying on - # python3-config exclusively - enablePython ? stdenv.hostPlatform == stdenv.buildPlatform, + enablePython ? !stdenv.hostPlatform.isStatic, # passthru nix-update-script, @@ -63,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: { installShellFiles ] ++ lib.optionals enablePython [ - python3 + python3Packages.python # for python3-config swig ]; @@ -89,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: { # capability dropping, currently mostly for plugins as those get spawned as root # see auditd-plugins(5) "--with-libcap-ng=yes" - (if enablePython then "--with-python" else "--without-python") + (lib.withFeature enablePython "python3") ]; __structuredAttrs = true; @@ -100,6 +97,12 @@ stdenv.mkDerivation (finalAttrs: { bashNonInteractive ]; + nativeCheckInputs = lib.optionals enablePython [ + python3Packages.pythonImportsCheckHook + ]; + + pythonImportsCheck = [ "audit" ]; + doCheck = true; postInstall = '' From d54599d8e5e9dde1fecabd23c810f1b7b04a542c Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Thu, 11 Sep 2025 09:50:41 +0200 Subject: [PATCH 06/12] audit: fix augenrules script --- pkgs/by-name/au/audit/package.nix | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix index 4e7fd04acb84..617d1f30f6d0 100644 --- a/pkgs/by-name/au/audit/package.nix +++ b/pkgs/by-name/au/audit/package.nix @@ -11,6 +11,10 @@ swig, libcap_ng, installShellFiles, + makeWrapper, + gawk, + gnugrep, + coreutils, enablePython ? !stdenv.hostPlatform.isStatic, @@ -58,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ autoreconfHook installShellFiles + makeWrapper ] ++ lib.optionals enablePython [ python3Packages.python # for python3-config @@ -109,6 +114,20 @@ stdenv.mkDerivation (finalAttrs: { installShellCompletion --bash init.d/audit.bash_completion ''; + postFixup = '' + substituteInPlace $bin/bin/augenrules \ + --replace-fail "/sbin/auditctl" "$bin/bin/auditctl" \ + --replace-fail "/bin/ls" "ls" + wrapProgram $bin/bin/augenrules \ + --prefix PATH : ${ + lib.makeBinPath [ + gawk + gnugrep + coreutils + ] + } + ''; + enableParallelBuilding = true; passthru = { From c98add0012fbf265bd16d417dcee1c962823eeb4 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 16:37:42 +0200 Subject: [PATCH 07/12] python3Packages.audit: init from audit --- pkgs/top-level/python-packages.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 478a19181288..d56697cbe826 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -1136,6 +1136,12 @@ self: super: with self; { audiotools = callPackage ../development/python-modules/audiotools { }; + audit = toPythonModule ( + pkgs.audit.override { + python3Packages = self; + } + ); + auditok = callPackage ../development/python-modules/auditok { }; auditwheel = callPackage ../development/python-modules/auditwheel { From 1884f0fa52aab905609d3ec3981f1e12f4b28e72 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Thu, 11 Sep 2025 09:50:00 +0200 Subject: [PATCH 08/12] nixos/audit: rename service to audit-rules-nixos to avoid collisions with the upstream unit --- nixos/modules/security/audit.nix | 5 ++++- nixos/tests/audit.nix | 6 +++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/nixos/modules/security/audit.nix b/nixos/modules/security/audit.nix index f50c465fde5b..849ff57c662c 100644 --- a/nixos/modules/security/audit.nix +++ b/nixos/modules/security/audit.nix @@ -95,7 +95,10 @@ in environment.systemPackages = [ pkgs.audit ]; - systemd.services.audit-rules = { + # upstream contains a audit-rules.service, which uses augenrules. + # That script does not handle cleanup correctly and insists on loading from /etc/audit. + # So, instead we have our own service for loading rules. + systemd.services.audit-rules-nixos = { description = "Load Audit Rules"; wantedBy = [ "sysinit.target" ]; before = [ diff --git a/nixos/tests/audit.nix b/nixos/tests/audit.nix index 0d732442ef4b..c5a69cc6e12a 100644 --- a/nixos/tests/audit.nix +++ b/nixos/tests/audit.nix @@ -31,7 +31,7 @@ }; testScript = '' - machine.wait_for_unit("audit-rules.service") + machine.wait_for_unit("audit-rules-nixos.service") machine.wait_for_unit("auditd.service") with subtest("Audit subsystem gets enabled"): @@ -46,8 +46,8 @@ machine.succeed("hello") print(machine.succeed("ausearch -k nixos-test -sc exit_group")) - with subtest("Stopping audit-rules.service disables the audit subsystem"): - machine.succeed("systemctl stop audit-rules.service") + with subtest("Stopping audit-rules-nixos.service disables the audit subsystem"): + machine.succeed("systemctl stop audit-rules-nixos.service") t.assertIn("enabled 0", machine.succeed("auditctl -s")) ''; From f063f32450a5f383e9a45667a576bdddfefd212c Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 16:59:39 +0200 Subject: [PATCH 09/12] nixos/auditd: Use new default socket path The default path of the audisp socket was chanegd in https://github.com/linux-audit/audit-userspace/commit/4ade1466f91dad3c33b2d92596ef8385f3bc5571 --- nixos/modules/security/auditd.nix | 2 +- nixos/tests/audit.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix index 036ce9c01cae..67c661bb4394 100644 --- a/nixos/modules/security/auditd.nix +++ b/nixos/modules/security/auditd.nix @@ -229,7 +229,7 @@ in path = lib.getExe' pkgs.audit "audisp-af_unix"; args = [ "0640" - "/var/run/audispd_events" + "/run/audit/audispd_events" "string" ]; format = "binary"; diff --git a/nixos/tests/audit.nix b/nixos/tests/audit.nix index c5a69cc6e12a..d3fc558aeec8 100644 --- a/nixos/tests/audit.nix +++ b/nixos/tests/audit.nix @@ -40,7 +40,7 @@ t.assertIn("backlog_limit 512", audit_status) with subtest("unix socket plugin activated"): - machine.succeed("stat /var/run/audispd_events") + machine.succeed("stat /run/audit/audispd_events") with subtest("Custom rule produces audit traces"): machine.succeed("hello") From 7d5e1d984bc04f1b13695fbe9ced102ef9bb980e Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Thu, 11 Sep 2025 10:02:44 +0200 Subject: [PATCH 10/12] nixos/auditd: use upstream unit --- nixos/modules/security/auditd.nix | 44 +++++++++---------------------- 1 file changed, 13 insertions(+), 31 deletions(-) diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix index 67c661bb4394..49a99ea30354 100644 --- a/nixos/modules/security/auditd.nix +++ b/nixos/modules/security/auditd.nix @@ -256,41 +256,23 @@ in }; }; - systemd.services.auditd = { - description = "Security Audit Logging Service"; - documentation = [ "man:auditd(8)" ]; - wantedBy = [ "sysinit.target" ]; - after = [ - "local-fs.target" - "systemd-tmpfiles-setup.service" - ]; - before = [ - "sysinit.target" - "shutdown.target" - ]; - conflicts = [ "shutdown.target" ]; + systemd.tmpfiles.packages = [ pkgs.audit.out ]; + systemd.packages = [ pkgs.audit.out ]; - unitConfig = { - DefaultDependencies = false; - RefuseManualStop = true; - ConditionVirtualization = "!container"; - ConditionKernelCommandLine = [ - "!audit=0" - "!audit=off" - ]; - }; + # will try to look in /etc for rules to load, which we don't set up + systemd.services.audit-rules.enable = lib.mkDefault false; + + systemd.services.auditd = { + wantedBy = [ "multi-user.target" ]; serviceConfig = { LogsDirectory = "audit"; - ExecStart = "${pkgs.audit}/bin/auditd -l -n -s nochange"; - Restart = "on-failure"; - # Do not restart for intentional exits. See EXIT CODES section in auditd(8). - RestartPreventExitStatus = "2 4 6"; - - # Upstream hardening settings - MemoryDenyWriteExecute = true; - LockPersonality = true; - RestrictRealtime = true; + RuntimeDirectory = "audit"; + ExecStart = [ + # the upstream unit does not allow symlinks, so clear and rewrite the ExecStart + "" + "${lib.getExe' pkgs.audit "auditd"} -l -s nochange" + ]; }; }; }; From 08e440629d0205f1e64df5308cf1945e7968a606 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 17:03:58 +0200 Subject: [PATCH 11/12] opensnitch: allow configuring audit socket path --- pkgs/by-name/op/opensnitch/package.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/pkgs/by-name/op/opensnitch/package.nix b/pkgs/by-name/op/opensnitch/package.nix index dc99acef4777..b682efc1bc1e 100644 --- a/pkgs/by-name/op/opensnitch/package.nix +++ b/pkgs/by-name/op/opensnitch/package.nix @@ -1,6 +1,7 @@ { buildGoModule, fetchFromGitHub, + fetchpatch, protobuf, go-protobuf, pkg-config, @@ -43,6 +44,20 @@ buildGoModule (finalAttrs: { hash = "sha256-XAR7yZjAzbMxIVGSV82agpAGwlejkILGgDI6iRicZuQ="; }; + patches = [ + (fetchpatch { + # https://github.com/evilsocket/opensnitch/pull/1418 + # allow configuring the audit socket path + url = "https://github.com/evilsocket/opensnitch/commit/f9358a464f204068359bf5174e6ff43288f12c7e.patch?full_index=1"; + hash = "sha256-s9CM1CyGpfJZXEtihXCM7nfPhBY8XuwubynTotqtf3E="; + }) + (fetchpatch { + # add missing colon in test definition + url = "https://github.com/evilsocket/opensnitch/commit/4b38ca1260295d2e0f8c4a7313529f83dcca4554.patch?full_index=1"; + hash = "sha256-/z3iFRpcv75FyarVnpK8/PTU2fcFHS+SNbHn7M5Etk8="; + }) + ]; + postPatch = '' # Allow configuring Version at build time substituteInPlace daemon/core/version.go --replace-fail "const " "var " From d4ebfe389fb23492887e76ae05bdeafb0bc937e0 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Thu, 11 Sep 2025 10:27:58 +0200 Subject: [PATCH 12/12] nixos/opensnitch: add audit socket path option --- nixos/modules/services/security/opensnitch.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix index 26c015a8107e..d6248bd15fe2 100644 --- a/nixos/modules/services/security/opensnitch.nix +++ b/nixos/modules/services/security/opensnitch.nix @@ -167,6 +167,15 @@ in ''; }; + Audit.AudispSocketPath = lib.mkOption { + type = lib.types.path; + default = "/run/audit/audispd_events"; + description = '' + Configure audit socket path. Used when + `settings.ProcMonitorMethod` is set to `audit`. + ''; + }; + Rules.Path = lib.mkOption { type = lib.types.path; default = "/var/lib/opensnitch/rules";