ansible：如何在 centos 7 上重新启动 auditd 服务时出现有关依赖项的错误

Question

在我的剧本中，我有一个更新 audit.rules 的任务，然后通知处理程序应该重新启动 auditd 服务。

task:
  - name:  6.6.7 - audit rules configuration
    template: src=X/ansible/templates/auditd_rules.j2
              dest=/etc/audit/rules.d/audit.rules
              backup=yes
              owner=root group=root mode=0640
     notify:
   - restart auditd


  handlers:
    - name: restart auditd
      service: name=auditd state=restarted

当 playbook 运行时，审核规则会更新并请求重新启动 auditd 但失败如下。

RUNNING HANDLER [restart auditd] ***********************************************
fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}

当我查看 auditd 的单元定义时，我可以看到 refuseManualStop=yes。这就是我无法重启服务的原因吗？怎么过来接受新的审计规则？

 systemctl cat auditd.service
# /usr/lib/systemd/system/auditd.service
[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules

[Install]
WantedBy=multi-user.target

Answer 1

将手动停止更改为NO并尝试

sudo service auditd restart

如果这行得通，那么代码也行得通

systemctl start auditd

和

systemctl enable auditd

适用于版本 CentOS version7。点击链接获取更多帮助。

Link

Auditd in CentOS7

Answer 2

我会验证 auditd 服务是否正确重新加载，因为即使将命令模块与您指定的命令一起使用也不会以您期望的方式工作或运行；

通过

确认

service auditd status

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-starting_the_audit_service.html

试试看

service auditd condrestart

:)

Answer 3

也许回答晚了，但如果其他人遇到同样的问题，您可以使用此命令为 auditd 导入新规则：

auditctl -R /path/to_your_rules_file

因此，无需重新启动auditd.service即可导入新规则

Answer 4

这已在 Red Hat Bugzilla #1026648 and Anisble Issue # 22171 (github) 报告中进行了探讨、讨论和解决（大部分）。

分辨率

使用 ansible service 模块参数 use=service 强制执行 /sbin/service 实用程序而不是 systemd 的收集事实值（调用 /sbin/systemctl) 像这样：
- - service: name=auditd state=restarted use=service
Example playbook (pastebin.com)

解决方法：

使用 ansible command 模块显式运行服务可执行文件，如下所示：
- - command: /sbin/service auditd restart

分析-根本原因：

This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.

It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.

RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)

Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.

Answer 5

您不应该更改参数 refuseManualStop，它用于保护您的系统安全。你可以做的是，在创建新规则后，重新启动主机，等待它，然后继续你的剧本。

剧本示例：

- name: Create new rules file
  copy:
    src: 01-personalized.rules
    dest: /etc/audit/rules.d/01-personalized.rules
    owner: root
    group: root
    mode: 0600
  register: result

- name: Reboot server
  shell: "sleep 5 && reboot"
  async: 1
  poll: 0
  when: result is changed

- name: Wait for server to become available
  wait_for_connection:
    delay: 60
    sleep: 5
    timeout: 300
  when: result is changed

ansible：如何在 centos 7 上重新启动 auditd 服务时出现有关依赖项的错误

ansible: how to restart auditd service on centos 7 get error about dependency

ansible

centos7

systemctl