auditd.scm 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374
  1. ;;; GNU Guix --- Functional package management for GNU
  2. ;;; Copyright © 2019 Danny Milosavljevic <dannym@scratchpost.org>
  3. ;;; Copyright © 2020 Robin Green <greenrd@greenrd.org>
  4. ;;;
  5. ;;; This file is part of GNU Guix.
  6. ;;;
  7. ;;; GNU Guix is free software; you can redistribute it and/or modify it
  8. ;;; under the terms of the GNU General Public License as published by
  9. ;;; the Free Software Foundation; either version 3 of the License, or (at
  10. ;;; your option) any later version.
  11. ;;;
  12. ;;; GNU Guix is distributed in the hope that it will be useful, but
  13. ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  14. ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. ;;; GNU General Public License for more details.
  16. ;;;
  17. ;;; You should have received a copy of the GNU General Public License
  18. ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
  19. (define-module (gnu services auditd)
  20. #:use-module (gnu services)
  21. #:use-module (gnu services configuration)
  22. #:use-module (gnu services base)
  23. #:use-module (gnu services shepherd)
  24. #:use-module (gnu packages admin)
  25. #:use-module (guix records)
  26. #:use-module (guix gexp)
  27. #:use-module (guix packages)
  28. #:export (auditd-configuration
  29. auditd-service-type
  30. %default-auditd-configuration-directory))
  31. (define auditd.conf
  32. (plain-file "auditd.conf" "log_file = /var/log/audit.log\nlog_format = \
  33. ENRICHED\nfreq = 1\nspace_left = 5%\nspace_left_action = \
  34. syslog\nadmin_space_left_action = ignore\ndisk_full_action = \
  35. ignore\ndisk_error_action = syslog\n"))
  36. (define %default-auditd-configuration-directory
  37. (computed-file "auditd"
  38. #~(begin
  39. (mkdir #$output)
  40. (copy-file #$auditd.conf
  41. (string-append #$output "/auditd.conf")))))
  42. (define-record-type* <auditd-configuration>
  43. auditd-configuration make-auditd-configuration
  44. auditd-configuration?
  45. (audit auditd-configuration-audit ; package
  46. (default audit))
  47. (configuration-directory auditd-configuration-configuration-directory)) ; file-like
  48. (define (auditd-shepherd-service config)
  49. (let* ((audit (auditd-configuration-audit config))
  50. (configuration-directory (auditd-configuration-configuration-directory config)))
  51. (list (shepherd-service
  52. (documentation "Auditd allows you to audit file system accesses and process execution.")
  53. (provision '(auditd))
  54. (start #~(make-forkexec-constructor
  55. (list (string-append #$audit "/sbin/auditd") "-c" #$configuration-directory)
  56. #:pid-file "/var/run/auditd.pid"))
  57. (stop #~(make-kill-destructor))))))
  58. (define auditd-service-type
  59. (service-type (name 'auditd)
  60. (description "Allows auditing file system accesses and process execution.")
  61. (extensions
  62. (list
  63. (service-extension shepherd-root-service-type
  64. auditd-shepherd-service)))
  65. (default-value
  66. (auditd-configuration
  67. (configuration-directory %default-auditd-configuration-directory)))))