On Thu, Jun 29, 2023, at 3:55 AM, Panu Matilainen wrote:
> last time I looked auditd is started later than
> systemd-sysusers. Hence not sure if sysusers would actually generate
> audit messages that auditd could pick them up.
For the rpm integration, "started later" is irrelevant as the user/group
creation takes place during rpm transactions.
Right, and that leads to an important point: for Anaconda based installations that run
dnf/rpm in a special installation environment, unless one has gone to significant effort
to inject some auditing setup into that, you aren't going to get events.
And the 90% case in cloud environments is to boot from pre-built images which will already
have these users enabled (sure you could audit user events from your build environment
but...why?).
So at best, the system user events only work for software injected *later*. And even
then, how much sense does it really make to audit the useradd component of the install
instead of the actual installation? And there's already rpm-plugin-audit for those
who want that...
Anyways though, it's probably not a hard patch to add the auditing to sysusers.