claudiomaradonna/castrum
1
0
Fork 0
Code Issues Pull requests Activity

fix(auditd): load changed rules in the same run #29

Merged
claudiomaradonna merged 1 commit from fix/auditd-load-rules into main 2026-10-08 09:19:34 +02:00
Conversation 0 Commits 1 Files changed 7 +94 -3
motoko commented 2026-10-08 09:09:59 +02:00
Collaborator
Copy link

Why

The auditd role wrote /etc/audit/rules.d and stopped. A new or changed rule reached the kernel only at auditd's next start, which Debian's unit allows only at boot because it refuses a manual restart.

What changed

  • A changed rule file notifies handlers that run augenrules --load, the step auditd.service itself runs at start, so rules apply in the run that wrote them.
  • A kernel whose audit configuration is locked (-e 2) takes no new rules until it boots. The handlers read auditctl -s first and report that case rather than failing.
  • New auditd_load_rules (default true) turns the load off where the kernel's audit system is not the host's to set, such as a container.

Verification

  • make check passed.
  • The handlers were run outside molecule against stub binaries: an unlocked kernel loads once, a locked one loads nothing and prints the reboot report, and check mode loads nothing.
  • Not run: make test (no podman in the agent sandbox). The auditd scenario now stubs auditctl and augenrules ahead of the real ones on PATH, and verify.yml asserts exactly one augenrules --load: once for the converge, none for the idempotence run.

Risks and follow-ups

  • If the auditd package's postinst calls augenrules without its full path, the stub records a second call and the exact-one assertion fails. make test settles it; the fix would be to assert at least one call.
## Why The auditd role wrote `/etc/audit/rules.d` and stopped. A new or changed rule reached the kernel only at auditd's next start, which Debian's unit allows only at boot because it refuses a manual restart. ## What changed - A changed rule file notifies handlers that run `augenrules --load`, the step `auditd.service` itself runs at start, so rules apply in the run that wrote them. - A kernel whose audit configuration is locked (`-e 2`) takes no new rules until it boots. The handlers read `auditctl -s` first and report that case rather than failing. - New `auditd_load_rules` (default `true`) turns the load off where the kernel's audit system is not the host's to set, such as a container. ## Verification - `make check` passed. - The handlers were run outside molecule against stub binaries: an unlocked kernel loads once, a locked one loads nothing and prints the reboot report, and check mode loads nothing. - Not run: `make test` (no podman in the agent sandbox). The auditd scenario now stubs `auditctl` and `augenrules` ahead of the real ones on PATH, and `verify.yml` asserts exactly one `augenrules --load`: once for the converge, none for the idempotence run. ## Risks and follow-ups - If the auditd package's postinst calls `augenrules` without its full path, the stub records a second call and the exact-one assertion fails. `make test` settles it; the fix would be to assert at least one call. 
The role wrote /etc/audit/rules.d and stopped, so a new or changed rule
reached the kernel only at auditd's next start, which Debian's unit
allows only at boot: it refuses a manual restart.

A changed rule file now notifies handlers that run `augenrules --load`,
the step auditd.service itself runs at start. A kernel whose audit
configuration is locked (`-e 2`) takes no new rules until it boots, so
the handlers read `auditctl -s` first and report that case instead of
failing. auditd_load_rules (default true) turns the load off where the
kernel's audit system is not the host's to set, such as a container.

The molecule scenario keeps the load on and puts stub auditctl and
augenrules ahead of the real ones on PATH; verify.yml asserts exactly
one `augenrules --load`: once for the converge that wrote the file,
none for the idempotence run. Outside molecule, the handlers were run
against stubs for an unlocked kernel (one load), a locked one (no load,
reboot report) and check mode (no load).
claudiomaradonna deleted branch fix/auditd-load-rules 2026-10-08 09:19:38 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
claudiomaradonna/castrum!29
No description provided.