Re: [atomic] auditd on atomic host

[Josh Berkus <jberkus redhat com>]

On 05/15/2017 02:55 PM, Aleks wrote:
> Hi all.
> 
> I was redirected from twitter
> ( https://twitter.com/Me2Digital/status/864124598320844800 ) to the
> mailing list to ask the following question.
> 
> do you know how I can add auditd container to the atomic host?
> 
> We need to send to a centralized system the logs from auditd.
> This is in a rpm based system possible due to the fact that the auditd
> is installed via rpm, but how is auditd integrated in atomic hosts?
> 
> Regards
> Aleks
> 

>From Dan Walsh, who's having some trouble posting on list this AM:

================

Yes, Is there a list or do you want to just forward my response.

auditd can be added to a atomic host in two different ways.

One would be to package it up in a system container and then have it be
run at boot time.

We should probably create an system container for this.

Second, would be you can install using rpm-ostree, which will install
the rpm and allow you to configure it.  Note this installs an additional
layer on top of the ostree.


rpm-ostree install auditd

reboot

Now you should see it on your system.

-- 
--
Josh Berkus
Project Atomic
Red Hat OSAS