Cfrgtkky

I'm trying to create a docker container with systemd enabled and install auditd on it.

I'm using the standard centos/systemd image provided in dockerhub.
But when I'm trying to start audit, it fails.

Here is the list of commands that I have done to create and get into the docker container:

docker run -d --rm --privileged --name systemd -v /sys/fs/cgroup:/sys/fs/cgroup:ro centos/systemd

docker exec -it systemd bash

Now, inside the docker container:

yum install audit

systemctl start auditd

I'm receiving the following error:

Job for auditd.service failed because the control process exited with error code. See "systemctl status auditd.service" and "journalctl -xe" for details.

Then I run:

 systemctl status auditd.service

And I'm getting this info:

auditd[182]: Error sending status request (Operation not permitted)

auditd[182]: Error sending enable request (Operation not permitted)

auditd[182]: Unable to set initial audit startup state to 'enable', exiting

auditd[182]: The audit daemon is exiting.

auditd[181]: Cannot daemonize (Success)

auditd[181]: The audit daemon is exiting.

systemd[1]: auditd.service: control process exited, code=exited status=1

systemd[1]: Failed to start Security Auditing Service.

systemd[1]: Unit auditd.service entered failed state.

systemd[1]: auditd.service failed.

Do you guys have any ideas on why this is happening?

Thank you.

See this discussion:

At the moment, auditd can be used inside a container only for aggregating
logs from other systems. It cannot be used to get events relevant to the
cotainer or the host OS. If you want to aggregate only, then set
local_events=no in auditd.conf.

Container support is still under development.

Also see this:

local_events
This yes/no keyword specifies whether or not to include local events. Normally you want local events so the default value is yes. Cases where you would set this to no is when you want to aggregate events only from the network. At the moment, this is useful if the audit daemon is running in a container. This option can only be set once at daemon start up. Reloading the config file has no effect.

So at least at Date: Thu, 19 Jul 2018 14:53:32 -0400, this feature not support, had to wait.