gnu/services/auditd.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2019 Danny Milosavljevic <dannym@scratchpost.org>
   3 ;;; Copyright © 2020 Robin Green <greenrd@greenrd.org>
   4 ;;;
   5 ;;; This file is part of GNU Guix.
   6 ;;;
   7 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   8 ;;; under the terms of the GNU General Public License as published by
   9 ;;; the Free Software Foundation; either version 3 of the License, or (at
  10 ;;; your option) any later version.
  11 ;;;
  12 ;;; GNU Guix is distributed in the hope that it will be useful, but
  13 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  14 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 ;;; GNU General Public License for more details.
  16 ;;;
  17 ;;; You should have received a copy of the GNU General Public License
  18 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  19
  20 (define-module (gnu services auditd)
  21   #:use-module (gnu services)
  22   #:use-module (gnu services configuration)
  23   #:use-module (gnu services base)
  24   #:use-module (gnu services shepherd)
  25   #:use-module (gnu packages admin)
  26   #:use-module (guix records)
  27   #:use-module (guix gexp)
  28   #:use-module (guix packages)
  29   #:export (auditd-configuration
  30             auditd-service-type
  31             %default-auditd-configuration-directory))
  32
  33 (define auditd.conf
  34   (plain-file "auditd.conf" "log_file = /var/log/audit.log\nlog_format = \
  35 ENRICHED\nfreq = 1\nspace_left = 5%\nspace_left_action = \
  36 syslog\nadmin_space_left_action = ignore\ndisk_full_action = \
  37 ignore\ndisk_error_action = syslog\n"))
  38
  39 (define %default-auditd-configuration-directory
  40   (computed-file "auditd"
  41                  #~(begin
  42                      (mkdir #$output)
  43                      (copy-file #$auditd.conf
  44                                 (string-append #$output "/auditd.conf")))))
  45
  46 (define-record-type* <auditd-configuration>
  47   auditd-configuration make-auditd-configuration
  48   auditd-configuration?
  49   (audit                   auditd-configuration-audit                          ; package
  50                            (default audit))
  51   (configuration-directory auditd-configuration-configuration-directory))      ; file-like
  52
  53 (define (auditd-shepherd-service config)
  54   (let* ((audit (auditd-configuration-audit config))
  55          (configuration-directory (auditd-configuration-configuration-directory config)))
  56     (list (shepherd-service
  57            (documentation "Auditd allows you to audit file system accesses and process execution.")
  58            (provision '(auditd))
  59            (start #~(make-forkexec-constructor
  60                      (list (string-append #$audit "/sbin/auditd") "-c" #$configuration-directory)
  61                      #:pid-file "/var/run/auditd.pid"))
  62            (stop #~(make-kill-destructor))))))
  63
  64 (define auditd-service-type
  65   (service-type (name 'auditd)
  66                 (description "Allows auditing file system accesses and process execution.")
  67                 (extensions
  68                  (list
  69                   (service-extension shepherd-root-service-type
  70                                      auditd-shepherd-service)))
  71                 (default-value
  72                   (auditd-configuration
  73                    (configuration-directory %default-auditd-configuration-directory)))))