From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 568D21FF185 for ; Mon, 4 Aug 2025 18:24:59 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 04E4836E90; Mon, 4 Aug 2025 18:26:27 +0200 (CEST) From: "Max R. Carrara" To: pve-devel@lists.proxmox.com Date: Mon, 4 Aug 2025 18:25:51 +0200 Message-Id: <20250804162551.594811-2-m.carrara@proxmox.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250804162551.594811-1-m.carrara@proxmox.com> References: <20250804162551.594811-1-m.carrara@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1754324735290 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.084 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH pve-manager master v1 1/1] pve8to9: check if unit 'systemd-journald-audit.socket' is active X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" ... and display a `log_notice()` to the user if it is in order to inform them about audit messages being logged during the upgrade, as well as suggesting that they stop and disable the unit before the upgrade. In Debian Bookworm and earlier, audit messages were not logged by default [0], whereas the unit was active by default. This was changed in between Bookworm and Trixie; the patch that changed the default was dropped [1], whereas the unit is now disabled. This means that the unit will remain active during the upgrade, which will in turn cause a lot of audit message log spam. [0]: https://salsa.debian.org/systemd-team/systemd/-/commit/07daa6196f9c92be8a0f552b1416576e80d054dc [1]: https://salsa.debian.org/systemd-team/systemd/-/commit/7c6ea97a1d7e438e6621c3b97ce472754fd3db43 Signed-off-by: Max R. Carrara --- PVE/CLI/pve8to9.pm | 51 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/PVE/CLI/pve8to9.pm b/PVE/CLI/pve8to9.pm index 8c26ddbd..b5b0c8bb 100644 --- a/PVE/CLI/pve8to9.pm +++ b/PVE/CLI/pve8to9.pm @@ -2069,6 +2069,56 @@ sub check_legacy_ipam_files { } } +sub check_journald_audit_socket { + my $unit = 'systemd-journald-audit.socket'; + + log_info("Checking whether systemd unit '$unit' is active..."); + + my ($res_is_enabled, $res_is_active) = (undef, undef); + + eval { + run_command( + ['systemctl', 'is-enabled', "$unit"], + outfunc => sub { + ($res_is_enabled) = @_; + chomp $res_is_enabled; + }, + noerr => 1, + ); + }; + + eval { + run_command( + ['systemctl', 'is-active', "$unit"], + outfunc => sub { + ($res_is_active) = @_; + chomp $res_is_active; + }, + noerr => 1, + ); + }; + + if (!defined($res_is_enabled) || !defined($res_is_active) || $res_is_enabled eq 'not-found') { + log_skip("Unit '$unit' not found"); + return undef; + } + + my $msg = + "Unit '$unit' is '$res_is_enabled' and '$res_is_active' - to prevent an excessive amount of" + . " audit messages being logged during the upgrade, it is recommended to stop and disable" + . " '$unit' beforehand." + . "\nThis can be achieved by running the following command:" + . "\n\n\tsystemctl disable --now $unit\n"; + + if ($res_is_enabled eq 'enabled' || $res_is_active eq 'active') { + log_notice($msg); + return undef; + } + + log_pass("Unit '$unit' is '$res_is_enabled' and '$res_is_active'"); + return undef; +} + sub check_misc { print_header("MISCELLANEOUS CHECKS"); my $ssh_config = eval { PVE::Tools::file_get_contents('/root/.ssh/config') }; @@ -2164,6 +2214,7 @@ sub check_misc { check_lvm_autoactivation(); check_rrd_migration(); check_legacy_ipam_files(); + check_journald_audit_socket(); } my sub colored_if { -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel