Re: [atomic] auditd on atomic host

[Aleks <al-projectatomic none at>]

Hi Daniel Walsh.

Daniel Walsh have written on Thu, 18 May 2017 13:14:22 -0400:

> On 05/17/2017 04:31 PM, Aleks wrote:
> > Hi Colin Walters.
> >
> > Colin Walters have written on Wed, 17 May 2017 13:09:12 -0400:
> >  
> >> On Wed, May 17, 2017, at 12:50 PM, Josh Berkus wrote:  
> >>> rpm-ostree install auditd    
> >> It's `audit` and not `auditd`.  However, this raises a little
> >> interesting point in that our host definitions aren't fully in sync
> >> across the distributions. Right now, Fedora Atomic *does* include
> >> `audit` (and `strace`) and a few other things.  
> > Sorry for my stupid question but what's the differnce between
> > `audit` and `auditd`.  
> They are the same, the rpm package is just called audit not auditd.
> > Oh yes I would really love to see strace, lsof, socat and other
> > tools in the atomic image out of the box.
> >
> > We have run a openshift pod on a atomic node and we have seen the
> > following message.
> >
> > ###
> > /sbin/auditctl –l
> > OUTPUT: The audit system is disabled
> > ###
> >
> > How can I enable it?
> > Does one of the option which Dan Walsh mentioned enable the audit
> > system?
> >
> > Regards
> > aleks
> >  
> I think just turning on the auditd service will fix this? 


Thanks for all input.

The mistake was that I thought only in OpenShift way not in atomic way.

After I have pulled the build audit image and run 'atomic install ...'
everything starts to work.

Regards
Aleks