Error running auditd inside centos docker container: “Unable to set initial audit startup state to 'enable', exiting”










0















I'm trying to create a docker container with systemd enabled and install auditd on it.



I'm using the standard centos/systemd image provided in dockerhub.
But when I'm trying to start audit, it fails.



Here is the list of commands that I have done to create and get into the docker container:



docker run -d --rm --privileged --name systemd -v /sys/fs/cgroup:/sys/fs/cgroup:ro centos/systemd
docker exec -it systemd bash


Now, inside the docker container:



yum install audit
systemctl start auditd


I'm receiving the following error:



Job for auditd.service failed because the control process exited with error code. See "systemctl status auditd.service" and "journalctl -xe" for details.


Then I run:



 systemctl status auditd.service


And I'm getting this info:



auditd[182]: Error sending status request (Operation not permitted)
auditd[182]: Error sending enable request (Operation not permitted)
auditd[182]: Unable to set initial audit startup state to 'enable', exiting
auditd[182]: The audit daemon is exiting.
auditd[181]: Cannot daemonize (Success)
auditd[181]: The audit daemon is exiting.
systemd[1]: auditd.service: control process exited, code=exited status=1
systemd[1]: Failed to start Security Auditing Service.
systemd[1]: Unit auditd.service entered failed state.
systemd[1]: auditd.service failed.


Do you guys have any ideas on why this is happening?



Thank you.










share|improve this question


























    0















    I'm trying to create a docker container with systemd enabled and install auditd on it.



    I'm using the standard centos/systemd image provided in dockerhub.
    But when I'm trying to start audit, it fails.



    Here is the list of commands that I have done to create and get into the docker container:



    docker run -d --rm --privileged --name systemd -v /sys/fs/cgroup:/sys/fs/cgroup:ro centos/systemd
    docker exec -it systemd bash


    Now, inside the docker container:



    yum install audit
    systemctl start auditd


    I'm receiving the following error:



    Job for auditd.service failed because the control process exited with error code. See "systemctl status auditd.service" and "journalctl -xe" for details.


    Then I run:



     systemctl status auditd.service


    And I'm getting this info:



    auditd[182]: Error sending status request (Operation not permitted)
    auditd[182]: Error sending enable request (Operation not permitted)
    auditd[182]: Unable to set initial audit startup state to 'enable', exiting
    auditd[182]: The audit daemon is exiting.
    auditd[181]: Cannot daemonize (Success)
    auditd[181]: The audit daemon is exiting.
    systemd[1]: auditd.service: control process exited, code=exited status=1
    systemd[1]: Failed to start Security Auditing Service.
    systemd[1]: Unit auditd.service entered failed state.
    systemd[1]: auditd.service failed.


    Do you guys have any ideas on why this is happening?



    Thank you.










    share|improve this question
























      0












      0








      0








      I'm trying to create a docker container with systemd enabled and install auditd on it.



      I'm using the standard centos/systemd image provided in dockerhub.
      But when I'm trying to start audit, it fails.



      Here is the list of commands that I have done to create and get into the docker container:



      docker run -d --rm --privileged --name systemd -v /sys/fs/cgroup:/sys/fs/cgroup:ro centos/systemd
      docker exec -it systemd bash


      Now, inside the docker container:



      yum install audit
      systemctl start auditd


      I'm receiving the following error:



      Job for auditd.service failed because the control process exited with error code. See "systemctl status auditd.service" and "journalctl -xe" for details.


      Then I run:



       systemctl status auditd.service


      And I'm getting this info:



      auditd[182]: Error sending status request (Operation not permitted)
      auditd[182]: Error sending enable request (Operation not permitted)
      auditd[182]: Unable to set initial audit startup state to 'enable', exiting
      auditd[182]: The audit daemon is exiting.
      auditd[181]: Cannot daemonize (Success)
      auditd[181]: The audit daemon is exiting.
      systemd[1]: auditd.service: control process exited, code=exited status=1
      systemd[1]: Failed to start Security Auditing Service.
      systemd[1]: Unit auditd.service entered failed state.
      systemd[1]: auditd.service failed.


      Do you guys have any ideas on why this is happening?



      Thank you.










      share|improve this question














      I'm trying to create a docker container with systemd enabled and install auditd on it.



      I'm using the standard centos/systemd image provided in dockerhub.
      But when I'm trying to start audit, it fails.



      Here is the list of commands that I have done to create and get into the docker container:



      docker run -d --rm --privileged --name systemd -v /sys/fs/cgroup:/sys/fs/cgroup:ro centos/systemd
      docker exec -it systemd bash


      Now, inside the docker container:



      yum install audit
      systemctl start auditd


      I'm receiving the following error:



      Job for auditd.service failed because the control process exited with error code. See "systemctl status auditd.service" and "journalctl -xe" for details.


      Then I run:



       systemctl status auditd.service


      And I'm getting this info:



      auditd[182]: Error sending status request (Operation not permitted)
      auditd[182]: Error sending enable request (Operation not permitted)
      auditd[182]: Unable to set initial audit startup state to 'enable', exiting
      auditd[182]: The audit daemon is exiting.
      auditd[181]: Cannot daemonize (Success)
      auditd[181]: The audit daemon is exiting.
      systemd[1]: auditd.service: control process exited, code=exited status=1
      systemd[1]: Failed to start Security Auditing Service.
      systemd[1]: Unit auditd.service entered failed state.
      systemd[1]: auditd.service failed.


      Do you guys have any ideas on why this is happening?



      Thank you.







      docker systemd audit






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 15 '18 at 1:49









      PedreiroPedreiro

      335314




      335314






















          1 Answer
          1






          active

          oldest

          votes


















          1














          See this discussion:




          At the moment, auditd can be used inside a container only for aggregating
          logs from other systems. It cannot be used to get events relevant to the
          cotainer or the host OS. If you want to aggregate only, then set
          local_events=no in auditd.conf.



          Container support is still under development.




          Also see this:




          local_events
          This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.




          So at least at Date: Thu, 19 Jul 2018 14:53:32 -0400, this feature not support, had to wait.






          share|improve this answer























          • I didn't know about the local_events. That explain the issue. Thanks.

            – Pedreiro
            Nov 15 '18 at 3:03










          Your Answer






          StackExchange.ifUsing("editor", function ()
          StackExchange.using("externalEditor", function ()
          StackExchange.using("snippets", function ()
          StackExchange.snippets.init();
          );
          );
          , "code-snippets");

          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "1"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53311314%2ferror-running-auditd-inside-centos-docker-container-unable-to-set-initial-audi%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          1














          See this discussion:




          At the moment, auditd can be used inside a container only for aggregating
          logs from other systems. It cannot be used to get events relevant to the
          cotainer or the host OS. If you want to aggregate only, then set
          local_events=no in auditd.conf.



          Container support is still under development.




          Also see this:




          local_events
          This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.




          So at least at Date: Thu, 19 Jul 2018 14:53:32 -0400, this feature not support, had to wait.






          share|improve this answer























          • I didn't know about the local_events. That explain the issue. Thanks.

            – Pedreiro
            Nov 15 '18 at 3:03















          1














          See this discussion:




          At the moment, auditd can be used inside a container only for aggregating
          logs from other systems. It cannot be used to get events relevant to the
          cotainer or the host OS. If you want to aggregate only, then set
          local_events=no in auditd.conf.



          Container support is still under development.




          Also see this:




          local_events
          This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.




          So at least at Date: Thu, 19 Jul 2018 14:53:32 -0400, this feature not support, had to wait.






          share|improve this answer























          • I didn't know about the local_events. That explain the issue. Thanks.

            – Pedreiro
            Nov 15 '18 at 3:03













          1












          1








          1







          See this discussion:




          At the moment, auditd can be used inside a container only for aggregating
          logs from other systems. It cannot be used to get events relevant to the
          cotainer or the host OS. If you want to aggregate only, then set
          local_events=no in auditd.conf.



          Container support is still under development.




          Also see this:




          local_events
          This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.




          So at least at Date: Thu, 19 Jul 2018 14:53:32 -0400, this feature not support, had to wait.






          share|improve this answer













          See this discussion:




          At the moment, auditd can be used inside a container only for aggregating
          logs from other systems. It cannot be used to get events relevant to the
          cotainer or the host OS. If you want to aggregate only, then set
          local_events=no in auditd.conf.



          Container support is still under development.




          Also see this:




          local_events
          This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.




          So at least at Date: Thu, 19 Jul 2018 14:53:32 -0400, this feature not support, had to wait.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Nov 15 '18 at 2:35









          lagomlagom

          1




          1












          • I didn't know about the local_events. That explain the issue. Thanks.

            – Pedreiro
            Nov 15 '18 at 3:03

















          • I didn't know about the local_events. That explain the issue. Thanks.

            – Pedreiro
            Nov 15 '18 at 3:03
















          I didn't know about the local_events. That explain the issue. Thanks.

          – Pedreiro
          Nov 15 '18 at 3:03





          I didn't know about the local_events. That explain the issue. Thanks.

          – Pedreiro
          Nov 15 '18 at 3:03



















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Stack Overflow!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53311314%2ferror-running-auditd-inside-centos-docker-container-unable-to-set-initial-audi%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          Top Tejano songwriter Luis Silva dead of heart attack at 64

          政党

          天津地下鉄3号線