nixos/auditd: support plugins #420043

LordGrimmauld · 2025-06-25T21:30:26Z

Upstream PR merged: linux-audit/audit-userspace#467

Needed to fix #419093

Things done

Add a 👍 reaction to pull requests you find important.

LordGrimmauld · 2025-06-25T21:34:14Z

This would be augmented by #420001, but not strictly necessary. I just believe it makes sense to adopt both, and bring both to modern standards. This is a good opportunity.

LordGrimmauld · 2025-06-28T12:44:32Z

The upstream PR just landed

LordGrimmauld · 2025-06-28T18:28:59Z

Ran the VM test by rebasing to master, worked perfectly fine

LordGrimmauld · 2025-06-30T13:34:33Z

linux-audit/audit-userspace#469 (comment)

A new release is planned for next Monday

if this isn't merged by then, i'll bump to 4.0.6 (assuming that is the next release tag) instead of fetching the patch.

It might also make sense to test service restarting in the VM test, though i did so by adding that on my local branch and it "just worked", so chances are we are unaffected by that.

nixos/modules/security/auditd.nix

mweinelt · 2025-07-01T23:10:25Z

nixos/modules/security/auditd.nix

+            ])
+          );
+        options = {
+          # space_left needs to be larger than admin_space_left, yet they default to be the same if left open.


Should this be an assertion?

Maybe. Problem is, this does not have to be a number, it can also be e.g. "10%", and the other can be a number, making assertions extremely awkward (and fully impossible if one is % and the other is absolute).

wrote an assert. It will not check the case where one is % and the other absolute, but it does check %/% and abs/abs

I have a gut feeling that this is one of those too complex assertions that will become a maintancen burden but since it's already written I won't ask you to undo it.

maybe, and then i can still remove it. But the regex to match for definitions is quite strict, so there shouldn't be anything unexpected happening here.

nixos/modules/security/auditd.nix

mweinelt · 2025-07-01T23:17:47Z

nixos/modules/security/auditd.nix

+    security.auditd.plugins = {
+      af_unix = {
+        path = lib.getExe' pkgs.audit "audisp-af_unix";
+        args = [
+          "0640"
+          "/var/run/audispd_events"
+          "string"
+        ];
+        format = "binary";
+      };
+      remote = {
+        path = lib.getExe' pkgs.audit "audisp-remote";
+        config = { };
+      };
+      filter = {
+        path = lib.getExe' pkgs.audit "audisp-filter";
+        args = [
+          "allowlist"
+          "/etc/audit/audisp-filter.conf"
+          (lib.getExe' pkgs.audit "audisp-syslog")
+          "LOG_USER"
+          "LOG_INFO"
+          "interpret"
+        ];
+        config = { };
+      };
+      syslog = {
+        path = lib.getExe' pkgs.audit "audisp-syslog";
+        args = [ "LOG_INFO" ];
+      };
+    };


This configuration is not introspectable from the options search. Reconfiguring the module from the config block is not ideal.

Yes, but i am not super sure how to do this better. I still want to allow for arbitrary plugins to be configurable, and these default plugins need to be configured somewhere.

I have no good answer for how to do this any other way, sorry.

if there isn't a better way to do this, then this should be fine. Yes its not really introspectable, but without a solution its not actionable either

Right, i added the definition to defaultText, that should be acceptable.

I think this is a good enough solution for now and definitely a significant improvement over the status quo.

LordGrimmauld · 2025-07-02T06:24:37Z

Thanks for the detailed review! I copied most of the descriptions from the man pages, but it is entirely fair to adjust them to our style of documentation that is properly searchable and readable.

I can try the assertion (though the logic will get awkward). Making the default plugins introspectable is more complex, not sure how to approach that yet.

LordGrimmauld · 2025-07-02T06:56:38Z

Seeing as i have some work to do here still, it is probably better to get #421698 merged (so we can start the staging cycle) and fix up the nix support to be able to configure this stuff later. That way we don't need to hurry as much, which is just prone to unnecessary mistakes.

nixos/modules/security/auditd.nix

LordGrimmauld · 2025-07-22T15:28:50Z

Update: Today i went to build and run the audit testsuite (https://github.com/linux-audit/audit-testsuite), with plans of adding that to a VM test. Result: Hilariously broken, mostly because we don't even configure audit at all currently (until this PR gets a merge). This is probably not great, working audit (with a green test suite) would be nice.

nikstur

Great work! There's some things to clean up but overall it's a great improvement and thus merge-worthy.

nixos/modules/security/auditd.nix

nikstur · 2025-08-03T18:46:57Z

nixos/modules/security/auditd.nix

+    security.auditd.plugins = {
+      af_unix = {
+        path = lib.getExe' pkgs.audit "audisp-af_unix";
+        args = [
+          "0640"
+          "/var/run/audispd_events"
+          "string"
+        ];
+        format = "binary";
+      };
+      remote = {
+        path = lib.getExe' pkgs.audit "audisp-remote";
+        config = { };
+      };
+      filter = {
+        path = lib.getExe' pkgs.audit "audisp-filter";
+        args = [
+          "allowlist"
+          "/etc/audit/audisp-filter.conf"
+          (lib.getExe' pkgs.audit "audisp-syslog")
+          "LOG_USER"
+          "LOG_INFO"
+          "interpret"
+        ];
+        config = { };
+      };
+      syslog = {
+        path = lib.getExe' pkgs.audit "audisp-syslog";
+        args = [ "LOG_INFO" ];
+      };
+    };


I think this is a good enough solution for now and definitely a significant improvement over the status quo.

nikstur · 2025-08-03T18:48:08Z

nixos/modules/security/auditd.nix

+      }
+    ) (lib.filterAttrs (_: v: v.config != null) cfg.plugins));
+
+    security.auditd.plugins = {


Be aware of overriding parts of this config. The way config is merged based on it's priority is no t immediately obvious. See #285114

There is no action you can take right now but when this module is used, this might come up in the future.

nikstur · 2025-08-03T18:48:57Z

nixos/modules/security/auditd.nix

+            ])
+          );
+        options = {
+          # space_left needs to be larger than admin_space_left, yet they default to be the same if left open.


I have a gut feeling that this is one of those too complex assertions that will become a maintancen burden but since it's already written I won't ask you to undo it.

LordGrimmauld · 2025-08-03T20:24:01Z

Thank you for the review, and happy to have this finally moving forward a bit :)

LordGrimmauld mentioned this pull request Jun 25, 2025

opensnitch{,-ui,ebpf}: is very broken #419093

Closed

LordGrimmauld force-pushed the audit-plugins branch 3 times, most recently from ea6d40c to a4bcc35 Compare June 28, 2025 12:42

LordGrimmauld marked this pull request as ready for review June 28, 2025 12:44

LordGrimmauld force-pushed the audit-plugins branch 3 times, most recently from 2bd5220 to c7b37e7 Compare June 28, 2025 14:50

mweinelt reviewed Jul 1, 2025

View reviewed changes

LordGrimmauld force-pushed the audit-plugins branch 2 times, most recently from 99e24cf to 57ddbb7 Compare July 2, 2025 06:53

LordGrimmauld mentioned this pull request Jul 2, 2025

audit: support plugins, adopt (staging part) #421698

Merged

13 tasks

LordGrimmauld marked this pull request as draft July 2, 2025 07:41

LordGrimmauld force-pushed the audit-plugins branch from 57ddbb7 to 01acf10 Compare July 2, 2025 07:55

LordGrimmauld marked this pull request as ready for review July 2, 2025 07:55

LordGrimmauld force-pushed the audit-plugins branch from 01acf10 to 18cf4bb Compare July 2, 2025 18:28

nixpkgs-ci bot added 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. labels Jul 2, 2025

mweinelt reviewed Jul 2, 2025

View reviewed changes

nixos/modules/security/auditd.nix Outdated Show resolved Hide resolved

nixos/modules/security/auditd.nix Outdated Show resolved Hide resolved

nixos/modules/security/auditd.nix Outdated Show resolved Hide resolved

nixos/modules/security/auditd.nix Outdated Show resolved Hide resolved

LordGrimmauld force-pushed the audit-plugins branch from 18cf4bb to 9eacded Compare July 2, 2025 19:20

LordGrimmauld changed the base branch from staging to staging-next July 5, 2025 13:27

nixpkgs-ci bot closed this Jul 5, 2025

nixpkgs-ci bot reopened this Jul 5, 2025

LordGrimmauld changed the title ~~audit: support plugins, adopt~~ nixos/auditd: support plugins Jul 5, 2025

LordGrimmauld force-pushed the audit-plugins branch from 9eacded to cd9f500 Compare July 9, 2025 14:12

LordGrimmauld changed the base branch from staging-next to master July 13, 2025 18:22

nixpkgs-ci bot closed this Jul 13, 2025

nixpkgs-ci bot reopened this Jul 13, 2025

LordGrimmauld force-pushed the audit-plugins branch from cd9f500 to 0646f66 Compare July 29, 2025 20:21

LordGrimmauld mentioned this pull request Jul 30, 2025

Improve security.audit{,d} #429553

Merged

13 tasks

nixpkgs-ci bot added the 2.status: merge conflict This PR has merge conflicts with the target branch label Jul 31, 2025

LordGrimmauld force-pushed the audit-plugins branch from 0646f66 to d34cdd8 Compare August 3, 2025 08:11

nixpkgs-ci bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Aug 3, 2025

nikstur reviewed Aug 3, 2025

View reviewed changes

LordGrimmauld added 5 commits August 3, 2025 22:19

nixos/auditd: support configuring service through nix

51a2cae

nixos/auditd: add plugin support

2c77ad7

nixos/auditd: add built-in plugins (default disabled)

ee774bb

nixos/tests/audit: test plugins

916d8b6

nixos/tests/audit: add grimmauld to maintainers

cf70c17

LordGrimmauld force-pushed the audit-plugins branch from d34cdd8 to cf70c17 Compare August 3, 2025 20:20

nikstur approved these changes Aug 4, 2025

View reviewed changes

nikstur merged commit 4896f8c into NixOS:master Aug 4, 2025
25 of 27 checks passed

Uh oh!

nixos/auditd: support plugins #420043

nixos/auditd: support plugins #420043

Uh oh!

Conversation

LordGrimmauld commented Jun 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

LordGrimmauld commented Jun 25, 2025

Uh oh!

LordGrimmauld commented Jun 28, 2025

Uh oh!

LordGrimmauld commented Jun 28, 2025

Uh oh!

LordGrimmauld commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LordGrimmauld commented Jul 2, 2025

Uh oh!

LordGrimmauld commented Jul 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

LordGrimmauld commented Jul 22, 2025

Uh oh!

nikstur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LordGrimmauld commented Aug 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

LordGrimmauld commented Jun 25, 2025 •

edited

Loading

LordGrimmauld commented Jun 30, 2025 •

edited

Loading