Ask Your Question
0

auditd.service fails on RPI3

asked 2016-09-02 16:13:13 -0500

dcpust gravatar image

updated 2016-09-09 08:42:42 -0500

Hi folks,

I need your help. I got myself a Raspberry Pi 3 and installed Fedora 24 on it , first Gnome, then LXDE. Both flavours worked in general (though Gnome was too sluggish), but everytime the Security Auditing Service auditd failed to start on boot. And also after booting, it was impossible to start via systemctl to get it running.

First of all I ran a dnf update as well as rpi-update, hoping that it would help, but it did not. Then, of course, I searched the internet in general and this forum specifically to find a solution to this problem:

  • I found Florían's post which describes exactley the problem I am facing, but his solution of reinstalling audit did not work in my case.
  • Interesting seems also this suggestion of Michael of shutting down the service, but I am hesitating being afraid of causing more harm than good.

As I am assuming that I am not the only one having these troubles and without the intention of kicking off a general discussion about whether F24 on a RPI is a good idea, I hope to receive a solution how to fix this problem.

My questions in particular are:

  • Would you recommend to simply disable this service? I mean on scale form 0 to 10, how important is auditd?

  • Or is there a way of getting auditd running? (Which would be the preferable option.)

I would be very thankful for any suggestions.


UPDATE (Fri Sep 9 14:30:00 2016)

Owing to probinson's post below, I gathered some more information on RPI kernel compilation and it seems that disabling the service is the better option according to these two sources:


It probably is intended, auditing support is a seriously huge amount of code (compared to some other features) that would likely provide absolutely zero benefit for a majority of users, and also can't be built as a loadable module. (Ferroin commented on 18 Mar)


Yes, it's disabled deliberately. Expensive settings with little benefit to the majority of users are not enabled on the Pi. CONFIG_AUDIT is not clearly a good thing

https://lwn.net/Articles/600568/

https://lwn.net/Articles/600578/

If you want it enabled you will need to provide justification including measures of cpu and memory usage with and without it. (popcornmix commented on 18 Mar)

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted
0

answered 2016-09-09 17:10:36 -0500

dcpust gravatar image

The solution is, I disabled auditd by entering following command:

dnf disable auditd

Everything's fine now.

edit flag offensive delete link more
2

answered 2016-09-07 04:39:19 -0500

pbrobinson gravatar image

Your kernel doesn't have the required options compiled in. You'll either need to fix that or disable the service.

edit flag offensive delete link more

Comments

Thank you for your advice. I will see where it leads me and keep this post updated.

dcpust gravatar imagedcpust ( 2016-09-09 08:25:19 -0500 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2016-09-02 16:13:13 -0500

Seen: 473 times

Last updated: Sep 09 '16