From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 887C31FF15C for ; Fri, 8 Aug 2025 10:14:12 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id DF1D110025; Fri, 8 Aug 2025 10:15:44 +0200 (CEST) Date: Fri, 08 Aug 2025 10:15:38 +0200 From: Fabian =?iso-8859-1?q?Gr=FCnbichler?= To: Proxmox VE development discussion References: <20250804162541.594590-1-m.carrara@proxmox.com> <20250804162541.594590-2-m.carrara@proxmox.com> In-Reply-To: <20250804162541.594590-2-m.carrara@proxmox.com> MIME-Version: 1.0 User-Agent: astroid/0.17.0 (https://github.com/astroidmail/astroid) Message-Id: <1754640697.7ckwfmmiat.astroid@yuna.none> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1754640917059 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.048 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [pve8to9.pm, proxmox.com] Subject: Re: [pve-devel] [PATCH pve-manager stable-8 v1 1/1] pve8to9: check if unit 'systemd-journald-audit.socket' is active X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" On August 4, 2025 6:25 pm, Max R. Carrara wrote: > ... and display a `log_notice()` to the user if it is in order to > inform them about audit messages being logged during the upgrade, > as well as suggesting that they stop and disable the unit before > the upgrade. > > In Debian Bookworm and earlier, audit messages were not logged by > default [0], whereas the unit was active by default. This was changed > in between Bookworm and Trixie; the patch that changed the default was > dropped [1], whereas the unit is now disabled. > > This means that the unit will remain active during the upgrade, which > will in turn cause a lot of audit message log spam. so this will warn about something that happens on every system(!), but is only relevant for the duration of the upgrade and just makes the logs more noisy? I am not sure that tradeoff is worth it, it is already noted in the upgrade guide, so people who read that will do it proactively anyway, and people who notice it during the upgrade can check there as well and see that it's a non-issue.. or maybe we could move it to `--full`? adding too many warnings (and lines in general) makes it much easier to miss actually relevant things.. in particular, after the upgrade is done it makes no sense to check this anymore, since the next step will be a reboot that gets rid of the excessive logging anyway.. > > [0]: https://salsa.debian.org/systemd-team/systemd/-/commit/07daa6196f9c92be8a0f552b1416576e80d054dc > [1]: https://salsa.debian.org/systemd-team/systemd/-/commit/7c6ea97a1d7e438e6621c3b97ce472754fd3db43 > > Signed-off-by: Max R. Carrara > --- > PVE/CLI/pve8to9.pm | 51 ++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 51 insertions(+) > > diff --git a/PVE/CLI/pve8to9.pm b/PVE/CLI/pve8to9.pm > index 426fa8a6..bd300d89 100644 > --- a/PVE/CLI/pve8to9.pm > +++ b/PVE/CLI/pve8to9.pm > @@ -2129,6 +2129,56 @@ sub check_legacy_sysctl_conf { > log_pass("Legacy file '$fn' exists but does not contain any settings."); > } > > +sub check_journald_audit_socket { > + my $unit = 'systemd-journald-audit.socket'; > + > + log_info("Checking whether systemd unit '$unit' is active..."); > + > + my ($res_is_enabled, $res_is_active) = (undef, undef); > + > + eval { > + run_command( > + ['systemctl', 'is-enabled', "$unit"], > + outfunc => sub { > + ($res_is_enabled) = @_; > + chomp $res_is_enabled; > + }, > + noerr => 1, > + ); > + }; > + > + eval { > + run_command( > + ['systemctl', 'is-active', "$unit"], > + outfunc => sub { > + ($res_is_active) = @_; > + chomp $res_is_active; > + }, > + noerr => 1, > + ); > + }; > + > + if (!defined($res_is_enabled) || !defined($res_is_active) || $res_is_enabled eq 'not-found') { > + log_skip("Unit '$unit' not found"); > + return undef; > + } > + > + my $msg = > + "Unit '$unit' is '$res_is_enabled' and '$res_is_active' - to prevent an excessive amount of" > + . " audit messages being logged during the upgrade, it is recommended to stop and disable" > + . " '$unit' beforehand." > + . "\nThis can be achieved by running the following command:" > + . "\n\n\tsystemctl disable --now $unit\n"; > + > + if ($res_is_enabled eq 'enabled' || $res_is_active eq 'active') { > + log_notice($msg); > + return undef; > + } > + > + log_pass("Unit '$unit' is '$res_is_enabled' and '$res_is_active'"); > + return undef; > +} > + > sub check_misc { > print_header("MISCELLANEOUS CHECKS"); > my $ssh_config = eval { PVE::Tools::file_get_contents('/root/.ssh/config') }; > @@ -2225,6 +2275,7 @@ sub check_misc { > check_rrd_migration(); > check_legacy_ipam_files(); > check_legacy_sysctl_conf(); > + check_journald_audit_socket(); > } > > my sub colored_if { > -- > 2.39.5 > > > > _______________________________________________ > pve-devel mailing list > pve-devel@lists.proxmox.com > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel > > > _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel