#1017736 auditd: noise service shutdown of dispatcher plugins

Package:
auditd
Source:
auditd
Description:
User space tools for security auditing
Submitter:
Christian Göttsche
Date:
2023-02-09 08:54:03 UTC
Severity:
normal
Tags:
#1017736#5
Date:
2022-08-19 17:42:50 UTC
From:
To:
From upstream report: https://github.com/linux-audit/audit-userspace/issues/272

Due to the Debian patch 01-no-refusemanualstop.patch auditd can be
restarted manually.
The systemd service file does not provide an `ExecStop=` directive,
thus (according to systemd.service[1]):

on service stops (system shutdown, package upgrade, manual restart
(due to configuration change), etc.) systemd sends SIGTERM (see
systemd.kill[2])) to all process in the control group of the unit,
including dispatch plugins like sedispatch.
This can lead to syslog noise like:

    Aug 04 12:26:19 dlaptop sedispatch[864]: sedispatch is exiting on
stop request
    Aug 04 12:26:19 dlaptop auditd[862]: plugin /usr/sbin/sedispatch
terminated unexpectedly
    Aug 04 12:26:19 dlaptop auditd[862]: plugin /usr/sbin/sedispatch
was restarted
    Aug 04 12:26:19 dlaptop sedispatch[5277]: sedispatch is exiting on stdin EOF

Maybe consider adding (see [2] for details):

    [Service]
    KillMode=mixed


[1]: https://www.freedesktop.org/software/systemd/man/systemd.service.html
[2]: https://www.freedesktop.org/software/systemd/man/systemd.kill.html
#1017736#12
Date:
2023-02-09 08:50:14 UTC
From:
To:
On Fri, 19 Aug 2022 19:42:50 +0200 =?UTF-8?Q?Christian_G=C3=B6ttsche?=  <cgzones@googlemail.com> wrote:

 > From upstream report:
https://github.com/linux-audit/audit-userspace/issues/272
 >

As mentioned in the upstream bug, I think that this should also be set
upstream as on shutdown/reboot, systemd WILL stop auditd too

I'm not sure that should be applied to debian only