systemd/units/systemd-journald-audit.socket

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Journal Audit Socket
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target
ConditionSecurity=audit
ConditionCapability=CAP_AUDIT_READ

[Socket]
Service=systemd-journald.service
ReceiveBuffer=128M
ListenNetlink=audit 1
PassCredentials=yes

[Install]
WantedBy=sockets.target
WantedBy=systemd-journald.service
license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 07:23:58 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
Add SPDX license headers to unit files 2017-11-18 19:35:03 +03:00			`#`
journald: if available pull audit messages from the kernel into journal logs 2014-11-03 22:58:24 +03:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=Journal Audit Socket`
			`Documentation=man:systemd-journald.service(8) man:journald.conf(5)`
			`DefaultDependencies=no`
			`Before=sockets.target`
core: introduce ConditionSecurity=audit And conditionalize journald audit support with it 2014-11-03 23:09:38 +03:00			`ConditionSecurity=audit`
units: conditionalize audit multicast socket on CAP_AUDIT_READ The multicast logic can only work if the capability is available, hence require it. 2015-05-20 18:40:05 +03:00			`ConditionCapability=CAP_AUDIT_READ`
journald: if available pull audit messages from the kernel into journal logs 2014-11-03 22:58:24 +03:00
			`[Socket]`
			`Service=systemd-journald.service`
			`ReceiveBuffer=128M`
			`ListenNetlink=audit 1`
			`PassCredentials=yes`
journal: give the ability to enable/disable systemd-journald-audit.socket Before this patch the only way to prevent journald from reading the audit messages was to mask systemd-journald-audit.socket. However this had main drawback that downstream couldn't ship the socket disabled by default (beside the fact that masking units is not supposed to be the usual way to disable them). Fixes #15777 2022-12-06 22:15:43 +03:00
			`[Install]`
			`WantedBy=sockets.target`
			`WantedBy=systemd-journald.service`