systemd/units/systemd-journald-audit.socket

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Journal Audit Socket
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target
ConditionSecurity=audit
ConditionCapability=CAP_AUDIT_READ

[Socket]
Service=systemd-journald.service
ReceiveBuffer=128M
ListenNetlink=audit 1
PassCredentials=yes
journald: if available pull audit messages from the kernel into journal logs 2014-11-03 22:58:24 +03:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=Journal Audit Socket`
			`Documentation=man:systemd-journald.service(8) man:journald.conf(5)`
			`DefaultDependencies=no`
			`Before=sockets.target`
core: introduce ConditionSecurity=audit And conditionalize journald audit support with it 2014-11-03 23:09:38 +03:00			`ConditionSecurity=audit`
units: conditionalize audit multicast socket on CAP_AUDIT_READ The multicast logic can only work if the capability is available, hence require it. 2015-05-20 18:40:05 +03:00			`ConditionCapability=CAP_AUDIT_READ`
journald: if available pull audit messages from the kernel into journal logs 2014-11-03 22:58:24 +03:00
			`[Socket]`
			`Service=systemd-journald.service`
			`ReceiveBuffer=128M`
			`ListenNetlink=audit 1`
			`PassCredentials=yes`