Home-Assistant/operating-system
1
0
Fork 0
mirror of https://github.com/home-assistant/operating-system.git synced 2025-12-24 04:18:30 +00:00
Code Activity

Use auditd to process AppArmor/audit logs (#3885)

Browse Source 
Use auditd so logs from AppArmor and other audit events are processed by that
instead of printed to the Systemd journal. This will reduce the log spam from
BPF usually present in host logs and still preserve the audit logs for
debugging.

The default configs seems to be sane for our purpose, rotating up to 5 files of
8MiB each. The difference is that /var/log/audit will be now on tmpfs but given
how AppArmor is used on typical HA setup, we don't need to preserve the logs
over reboots.
This commit is contained in:
Jan Čermák
2025-02-20 17:45:23 +01:00
committed by GitHub
parent 4ab51e780c
commit e158fbc834
19 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
buildroot-external/configs/generic_aarch64_defconfig
View File

@@ -135,6 +135,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_OPENVMTOOLS=y BR2_PACKAGE_OPENVMTOOLS=y

1
buildroot-external/configs/generic_x86_64_defconfig
View File

@@ -135,6 +135,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_OPENVMTOOLS=y BR2_PACKAGE_OPENVMTOOLS=y

1
buildroot-external/configs/green_defconfig
View File

@@ -114,6 +114,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/khadas_vim3_defconfig
View File

@@ -109,6 +109,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/odroid_c2_defconfig
View File

@@ -109,6 +109,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/odroid_c4_defconfig
View File

@@ -107,6 +107,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/odroid_m1_defconfig
View File

@@ -109,6 +109,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/odroid_m1s_defconfig
View File

@@ -109,6 +109,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/odroid_n2_defconfig
View File

@@ -109,6 +109,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/odroid_xu4_defconfig
View File

@@ -109,6 +109,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/ova_defconfig
View File

@@ -138,6 +138,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_OPENVMTOOLS=y BR2_PACKAGE_OPENVMTOOLS=y

1
buildroot-external/configs/rpi2_defconfig
View File

@@ -112,6 +112,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/rpi3_64_defconfig
View File

@@ -113,6 +113,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/rpi3_defconfig
View File

@@ -114,6 +114,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/rpi4_64_defconfig
View File

@@ -114,6 +114,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/rpi4_defconfig
View File

@@ -113,6 +113,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/rpi5_64_defconfig
View File

@@ -112,6 +112,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/tinker_defconfig
View File

@@ -109,6 +109,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y

1
buildroot-external/configs/yellow_defconfig
View File

@@ -116,6 +116,7 @@ BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION=y
BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR=y
BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_APPARMOR_PROFILES=y
BR2_PACKAGE_TINI=y BR2_PACKAGE_TINI=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_CLI=y
BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_PROCPS_NG=y BR2_PACKAGE_PROCPS_NG=y