| /systemd-251/src/core/ |
| D | selinux-access.c | 47 const struct audit_info *audit = auditdata; in audit_callback() local
54 if (sd_bus_creds_get_audit_login_uid(audit->creds, &login_uid) >= 0) in audit_callback()
56 if (sd_bus_creds_get_euid(audit->creds, &uid) >= 0) in audit_callback()
58 if (sd_bus_creds_get_egid(audit->creds, &gid) >= 0) in audit_callback()
64 … audit->path ? " path=\"" : "", strempty(audit->path), audit->path ? "\"" : "", in audit_callback()
65 … audit->cmdline ? " cmdline=\"" : "", strempty(audit->cmdline), audit->cmdline ? "\"" : "", in audit_callback()
66 … audit->function ? " function=\"" : "", strempty(audit->function), audit->function ? "\"" : ""); in audit_callback()
|
| D | meson.build | 6 audit-fd.c
7 audit-fd.h
|
| /systemd-251/src/fundamental/ |
| D | efivars-fundamental.c | 21 sd_bool audit, in decode_secure_boot_mode() argument
26 if (secure && deployed && !audit && !setup) in decode_secure_boot_mode()
28 if (secure && !deployed && !audit && !setup) in decode_secure_boot_mode()
30 if (!secure && !deployed && audit && setup) in decode_secure_boot_mode()
32 if (!secure && !deployed && !audit && setup) in decode_secure_boot_mode()
37 if (!secure && !deployed && !audit && !setup) in decode_secure_boot_mode()
|
| D | efivars-fundamental.h | 35 sd_bool audit,
|
| /systemd-251/src/boot/efi/ |
| D | secure-boot.c | 17 BOOLEAN secure, audit = FALSE, deployed = FALSE, setup = FALSE; in secure_boot_mode() local
26 (void) efivar_get_boolean_u8(EFI_GLOBAL_GUID, L"AuditMode", &audit); in secure_boot_mode()
30 return decode_secure_boot_mode(secure, audit, deployed, setup); in secure_boot_mode()
|
| /systemd-251/src/journal/ |
| D | meson.build | 4 'journald-audit.c',
5 'journald-audit.h',
117 [files('fuzz-journald-audit.c',
|
| /systemd-251/units/ |
| D | systemd-journald-audit.socket | 15 ConditionSecurity=audit
21 ListenNetlink=audit 1
|
| D | systemd-journald.service.in | 15 After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket syslog.…
36 Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket
|
| D | meson.build | 127 ['systemd-journald-audit.socket', '',
|
| /systemd-251/src/basic/ |
| D | efivars.c | 344 int audit = read_flag(EFI_GLOBAL_VARIABLE(AuditMode)); in efi_get_secure_boot_mode() local
348 secure, audit, deployed, setup); in efi_get_secure_boot_mode()
350 return (cache = decode_secure_boot_mode(secure, audit > 0, deployed > 0, setup > 0)); in efi_get_secure_boot_mode()
|
| D | meson.build | 16 'audit-util.c',
17 'audit-util.h',
|
| /systemd-251/src/libsystemd/ |
| D | meson.build | 4 'sd-journal/audit-type.c',
5 'sd-journal/audit-type.h',
36 'linux/audit.h']
209 [files('sd-journal/test-audit-type.c')],
|
| /systemd-251/test/fuzz/fuzz-journald-audit/ |
| D | basic | 1 audit(1542398162.211:744): pid=7376 uid=1000 auid=1000 ses=6 subj=unconfined_u:unconfined_r:unconfi…
|
| D | crash | 1 audit(1542398162.211:744) pid=7376 uid=1000 auid=1000 ses=6 subj=unconfined_u:unconfined_r:unconfin…
|
| /systemd-251/mkosi.default.d/fedora/ |
| D | 10-mkosi.fedora | 27 pkgconfig(audit)
|
| /systemd-251/test/ |
| D | mkosi.default.networkd-test | 26 audit-libs-devel
|
| /systemd-251/mkosi.default.d/centos_epel/ |
| D | 10-mkosi.centos_epel | 32 pkgconfig(audit)
|
| /systemd-251/src/shared/ |
| D | logs-show.c | 218 bool audit, in print_multiline() argument
231 if (audit && strempty(color_on)) { in print_multiline()
447 bool ellipsized = false, audit; in output_short() local
500 audit = streq_ptr(transport, "audit"); in output_short()
618 print_multiline(f, n + 2, n_columns, flags, p, audit, in output_short()
|
| /systemd-251/docs/ |
| D | CONTAINER_INTERFACE.md | 340 namespaces. The kernel's audit subsystem is still not virtualized for
342 actual attempt to make use of the audit subsystem will fail. Note that
343 systemd's audit support is partially conditioned on these capabilities, thus
346 systemd will assume that audit is available and works, and some components
348 native support for container-virtualized audit, adding the capability to the
|
| D | JOURNAL_NATIVE_PROTOCOL.md | 15 * Audit records via the kernel's audit subsystem
|
| D | ROOT_STORAGE_DAEMONS.md | 168 not-so-obvious such as security contexts or audit trails) from its parent
|
| D | ENVIRONMENT.md | 109 for example in `systemd-nspawn`, will be logged to the audit log, if the
|
| /systemd-251/ |
| D | README | 165 line option "audit=0", or turn it off at kernel compile time using:
171 with audit being enabled. This works correctly only on kernels 3.14 and
172 newer though. TL;DR: turn audit off, still.
|
| D | meson_options.txt | 358 option('audit', type : 'combo', choices : ['auto', 'true', 'false'], combo
|
| /systemd-251/man/rules/ |
| D | meson.build | 932 'systemd-journald-audit.socket',
|