Commit f551d91f authored by benaryorg's avatar benaryorg Committed by github-actions[bot]
Browse files

nixos/systemd: unconditional systemd-journald-audit.socket 

Containers did not have *systemd-journald-audit.socket* in *additionalUpstreamSystemUnits*, which meant that the unit was not provided.
However the *wantedBy* was added without any additional check, therefore creating an empty unit with just the *WantedBy* on *boot.isContainer* machines.
This caused `systemd-analyze verify` to fail:

```text
systemd-journald-audit.socket: Unit has no Listen setting (ListenStream=, ListenDatagram=, ListenFIFO=, ...). Refusing.
systemd-journald-audit.socket: Cannot add dependency job, ignoring: Unit systemd-journald-audit.socket has a bad unit file setting.
systemd-journald-audit.socket: Cannot add dependency job, ignoring: Unit systemd-journald-audit.socket has a bad unit file setting.
```

The upstream unit already contains the following, which should make it safe to include regardless:

```ini
[Unit]
ConditionSecurity=audit
ConditionCapability=CAP_AUDIT_READ
```

For reference, this popped up in the context of #[360426](https://redirect.github.com/NixOS/nixpkgs/issues/360426) as well as #[407696](https://redirect.github.com/NixOS/nixpkgs/pull/407696

).

Co-authored-by: default avatarBruce Toll <4109762+tollb@users.noreply.github.com>
Signed-off-by: default avatarbenaryorg <binary@benary.org>
(cherry picked from commit e434130d)
parent 0c6b3ff3

nixos/modules/system/boot/systemd/journald.nix

+13 −16
Original line number Diff line number Diff line
@@ -116,8 +116,7 @@ in 
  };



  config = {

    systemd.additionalUpstreamSystemUnits =

      [

    systemd.additionalUpstreamSystemUnits = [

      "systemd-journald.socket"

      "systemd-journald@.socket"

      "systemd-journald-varlink@.socket"
@@ -126,9 +125,7 @@ in 
      "systemd-journal-flush.service"

      "systemd-journal-catalog-update.service"

      "systemd-journald-sync@.service"

      ]

      ++ (lib.optional (!config.boot.isContainer) "systemd-journald-audit.socket")

      ++ [

      "systemd-journald-audit.socket"

      "systemd-journald-dev-log.socket"

      "syslog.socket"

    ];

nixos/tests/systemd-journal.nix

+16 −0
Original line number Diff line number Diff line
@@ -24,6 +24,12 @@ import ./make-test-python.nix ( 
      boot.kernel.sysctl."kernel.printk_ratelimit" = 0;

      boot.kernelParams = [ "audit_backlog_limit=8192" ];

    };

    nodes.containerCheck = {

      containers.c1 = {

        autoStart = true;

        config = { };

      };

    };



    testScript = ''

      machine.wait_for_unit("multi-user.target")
@@ -56,6 +62,16 @@ import ./make-test-python.nix ( 
        # logs ideally should NOT end up in kmesg, but they do due to

        # https://github.com/systemd/systemd/issues/15324

        journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")





      with subtest("container systemd-journald-audit not running"):

        containerCheck.wait_for_unit("multi-user.target");

        containerCheck.wait_until_succeeds("systemctl -M c1 is-active default.target");



        # systemd-journald-audit.socket should exist but not run due to the upstream unit's `Condition*` settings

        (status, output) = containerCheck.execute("systemctl -M c1 is-active systemd-journald-audit.socket")

        containerCheck.log(output)

        assert status == 3 and output == "inactive\n", f"systemd-journald-audit.socket should exist in a container but remain inactive, was {output}"

    '';

  }

)