On Thu, Jun 29, 2023, at 3:55 AM, Panu Matilainen wrote: >> last time I looked auditd is started later than >> systemd-sysusers. Hence not sure if sysusers would actually generate >> audit messages that auditd could pick them up. > > For the rpm integration, "started later" is irrelevant as the user/group > creation takes place during rpm transactions. Right, and that leads to an important point: for Anaconda based installations that run dnf/rpm in a special installation environment, unless one has gone to significant effort to inject some auditing setup into that, you aren't going to get events. And the 90% case in cloud environments is to boot from pre-built images which will already have these users enabled (sure you could audit user events from your build environment but...why?). So at best, the system user events only work for software injected *later*. And even then, how much sense does it really make to audit the useradd component of the install instead of the actual installation? And there's already rpm-plugin-audit for those who want that... Anyways though, it's probably not a hard patch to add the auditing to sysusers. _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
