错误 运行 auditd inside centos docker container: "Unable to set initial audit startup state to 'enable', exiting"
Error running auditd inside centos docker container: "Unable to set initial audit startup state to 'enable', exiting"
我正在尝试创建一个启用 systemd 的 docker 容器并在其上安装 auditd。
我正在使用 dockerhub 中提供的标准 centos/systemd 图片。
但是当我尝试开始审核时，它失败了。
这是我创建并进入 docker 容器的命令列表：
docker run -d --rm --privileged --name systemd -v /sys/fs/cgroup:/sys/fs/cgroup:ro centos/systemd
docker exec -it systemd bash
现在，在 docker 容器内：
yum install audit
systemctl start auditd
我收到以下错误：
Job for auditd.service failed because the control process exited with error code. See "systemctl status auditd.service" and "journalctl -xe" for details.
那我运行:
systemctl status auditd.service
我得到了这个信息：
auditd[182]: Error sending status request (Operation not permitted)
auditd[182]: Error sending enable request (Operation not permitted)
auditd[182]: Unable to set initial audit startup state to 'enable', exiting
auditd[182]: The audit daemon is exiting.
auditd[181]: Cannot daemonize (Success)
auditd[181]: The audit daemon is exiting.
systemd[1]: auditd.service: control process exited, code=exited status=1
systemd[1]: Failed to start Security Auditing Service.
systemd[1]: Unit auditd.service entered failed state.
systemd[1]: auditd.service failed.
你们知道为什么会这样吗？
谢谢。
看到这个discussion:
At the moment, auditd can be used inside a container only for aggregating
logs from other systems. It cannot be used to get events relevant to the
container or the host OS. If you want to aggregate only, then set
local_events=no in auditd.conf.
Container support is still under development.
另见 this:
local_events
This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.
所以至少在 Date: Thu, 19 Jul 2018 14:53:32 -0400，此功能不支持，必须等待。
我正在尝试创建一个启用 systemd 的 docker 容器并在其上安装 auditd。
我正在使用 dockerhub 中提供的标准 centos/systemd 图片。
但是当我尝试开始审核时，它失败了。
这是我创建并进入 docker 容器的命令列表：
docker run -d --rm --privileged --name systemd -v /sys/fs/cgroup:/sys/fs/cgroup:ro centos/systemd
docker exec -it systemd bash
现在，在 docker 容器内：
yum install audit
systemctl start auditd
我收到以下错误：
Job for auditd.service failed because the control process exited with error code. See "systemctl status auditd.service" and "journalctl -xe" for details.
那我运行:
systemctl status auditd.service
我得到了这个信息：
auditd[182]: Error sending status request (Operation not permitted)
auditd[182]: Error sending enable request (Operation not permitted)
auditd[182]: Unable to set initial audit startup state to 'enable', exiting
auditd[182]: The audit daemon is exiting.
auditd[181]: Cannot daemonize (Success)
auditd[181]: The audit daemon is exiting.
systemd[1]: auditd.service: control process exited, code=exited status=1
systemd[1]: Failed to start Security Auditing Service.
systemd[1]: Unit auditd.service entered failed state.
systemd[1]: auditd.service failed.
你们知道为什么会这样吗？
谢谢。
看到这个discussion:
At the moment, auditd can be used inside a container only for aggregating logs from other systems. It cannot be used to get events relevant to the container or the host OS. If you want to aggregate only, then set local_events=no in auditd.conf.
Container support is still under development.
另见 this:
local_events This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.
所以至少在 Date: Thu, 19 Jul 2018 14:53:32 -0400，此功能不支持，必须等待。