Re: [atomic] auditd on atomic host

[Daniel Walsh <dwalsh redhat com>]

On 05/17/2017 04:31 PM, Aleks wrote:
> Hi Colin Walters.
>
> Colin Walters have written on Wed, 17 May 2017 13:09:12 -0400:
>
>> On Wed, May 17, 2017, at 12:50 PM, Josh Berkus wrote:
>>> rpm-ostree install auditd  
>> It's `audit` and not `auditd`.  However, this raises a little
>> interesting point in that our host definitions aren't fully in sync
>> across the distributions. Right now, Fedora Atomic *does* include
>> `audit` (and `strace`) and a few other things.
> Sorry for my stupid question but what's the differnce between `audit`
> and `auditd`.
They are the same, the rpm package is just called audit not auditd.
> Oh yes I would really love to see strace, lsof, socat and other tools
> in the atomic image out of the box.
>
> We have run a openshift pod on a atomic node and we have seen the
> following message.
>
> ###
> /sbin/auditctl –l
> OUTPUT: The audit system is disabled
> ###
>
> How can I enable it?
> Does one of the option which Dan Walsh mentioned enable the audit
> system?
>
> Regards
> aleks
>
I think just turning on the auditd service will fix this?