Merged
Conversation
nixpkgs-ci
bot
added
10.rebuild-linux: 1-10
Contributor
|
|
Contributor
LordGrimmauld
left a comment
LordGrimmauld
left a comment
There was a problem hiding this comment.
A couple of nits, the overall changes look very sensible.
diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix
index 2dea938acc7b..036ce9c01cae 100644
--- a/nixos/modules/security/auditd.nix
+++ b/nixos/modules/security/auditd.nix
@@ -202,7 +202,7 @@ in
}
];
- # Starting auditd should also enable loading the audit rules..
+ # Starting the userspace daemon should also enable audit in the kernel
security.audit.enable = lib.mkDefault true;
# setting this to anything other than /etc/audit/plugins.d will break, so we pin it hereThis comment is now inaccurate and should reflect the auditd module is only the user space daemon.
diff --git a/nixos/tests/audit.nix b/nixos/tests/audit.nix
index 7f1280060824..074af12b4c5f 100644
--- a/nixos/tests/audit.nix
+++ b/nixos/tests/audit.nix
@@ -33,8 +33,10 @@
machine.wait_for_unit("audit-rules.service")
machine.wait_for_unit("auditd.service")
- with subtest("Audit subsystem gets enabled"):
- assert "enabled 1" in machine.succeed("auditctl -s")
+ with subtest("Audit subsystem gets enabled with correct backlog limits"):
+ audit_status = machine.succeed("auditctl -s")
+ assert "enabled 1" in audit_status, "expected audit to be enabled"
+ assert "backlog_limit 1024" in audit_status, "expected backlog limit 1024"
with subtest("unix socket plugin activated"):
machine.succeed("stat /var/run/audispd_events")the backlog_limit being different from kernel default might warrant a test to make sure its picked up correctly. Otherwise we might miss if e.g. the kernel flag is renamed or something like that.
Makes the audit module responsible for setting up the audit subsystem of the kernel. The auditd module is now only responsible for setting up the daemon. Enable the audit subsystem early via kernelParams. Increase the default audit backlog limit so that it works out of the box for a normal system. Remove a superfluous and pointless test case.
nikstur
force-pushed
the
fix-journald-audit
branch
from
dbfff11 to
439d68b
Compare
LordGrimmauld
approved these changes
Aug 9, 2025
Contributor
LordGrimmauld
left a comment
LordGrimmauld
left a comment
There was a problem hiding this comment.
Yes, this looks very sensible now, thank you
nixpkgs-ci
bot
added
the
12.approvals: 1
13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up on #429553
Fixes
nixosTests.systemd-journalwhich is currently broken on master.Makes the audit module responsible for setting up the audit subsystem of the kernel. The auditd module is now only responsible for setting up the daemon.
Enable the audit subsystem early via kernelParams.
Increase the default audit backlog limit so that it works out of the box for a normal system.
Remove a superfluous and pointless test case.
Things done
passthru.tests.nixpkgs-reviewon this PR. See nixpkgs-review usage../result/bin/.Add a 👍 reaction to pull requests you find important.