Hi,
I am writing this email to report an issue while using audit inside a
docker container (with CentOS 7.5 as base layer). It installs fine, but,
when I try to do service auditd start, it fails with the message"
"Redirecting to /bin/systemctl start auditd.service Job for auditd.service
failed because the control process exited with error code. See "systemctl
status auditd.service" and "journalctl -xe" for details."
"
● auditd.service - Security Auditing Service
Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor
preset: enabled) Active: failed (Result: exit-code) since Thu 2018-07-19
18:12:50 UTC; 2min 8s ago Docs: man:auditd(8)
https://github.com/linux-audit/audit-documentation
Process: 12119 ExecStart=/sbin/auditd (code=exited, status=1/FAILURE)
Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Starting Security Auditing
Service... Jul 19 18:12:50 wanly1.fyre.ibm.com auditd[12120]: Started
dispatcher: /sbin/audispd pid: 12122 Jul 19 18:12:50 wanly1.fyre.ibm.com
auditd[12120]: Error sending status request (Operation not permitted) Jul
19 18:12:50 wanly1.fyre.ibm.com auditd[12120]: Error sending enable
request (Operation not permitted) Jul 19 18:12:50 wanly1.fyre.ibm.com
systemd[1]: auditd.service: control process exited, code=exited status=1
Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Failed to start Security
Auditing Service. Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Unit
auditd.service entered failed state. Jul 19 18:12:50 wanly1.fyre.ibm.com
systemd[1]: auditd.service failed."
Can someone please help me figure this issue out.
At the moment, auditd can be used inside a container only for aggregating
logs from other systems. It cannot be used to get events relevant to the
cotainer or the host OS. If you want to aggregate only, then set
local_events=no in auditd.conf.
Container support is still under development.
-Steve