mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-07-19 01:06:27 +00:00
44cbd38650
Two things to note here: we unfortunately can't just exec audit, because something needs to load the rules in beforehand. Second, it also dies if it can't re-nice itself, so we have to give it CAP_SYS_NICE as well as the audit caps. I didn't add this to the default linuxkit.yml because the linuxkit/audit repo doesn't exist yet, but we should probably (?) do that. Additionally, we should provide the kernel parameter audit=1, otherwise according to auditd's man pages, we can't audit some early tasks. Closes #52 Signed-off-by: Tycho Andersen <tycho@docker.com>
33 lines
700 B
Plaintext
33 lines
700 B
Plaintext
#
|
|
# This file controls the configuration of the audit daemon
|
|
#
|
|
|
|
local_events = yes
|
|
write_logs = no
|
|
log_format = RAW
|
|
flush = INCREMENTAL_ASYNC
|
|
freq = 50
|
|
priority_boost = 4
|
|
disp_qos = lossy
|
|
dispatcher = /sbin/audispd
|
|
name_format = NONE
|
|
##name = mydomain
|
|
max_log_file_action = ROTATE
|
|
space_left = 75
|
|
space_left_action = SYSLOG
|
|
action_mail_acct = root
|
|
admin_space_left = 50
|
|
admin_space_left_action = SUSPEND
|
|
disk_full_action = SUSPEND
|
|
disk_error_action = SUSPEND
|
|
use_libwrap = yes
|
|
##tcp_listen_port =
|
|
tcp_listen_queue = 5
|
|
tcp_max_per_addr = 1
|
|
##tcp_client_ports = 1024-65535
|
|
tcp_client_max_idle = 0
|
|
enable_krb5 = no
|
|
krb5_principal = auditd
|
|
##krb5_key_file = /etc/audit/audit.key
|
|
distribute_network = no
|