Skip to content
  • Lennart Poettering's avatar
    audit: since nspawn now sets CAP_AUDIT_CONTROL for containers we cannot user... · 9a3ef988
    Lennart Poettering authored
    audit: since nspawn now sets CAP_AUDIT_CONTROL for containers we cannot user this anymore to skip audit session ID retrieval
    
    As audit is still broken in containers we need a reliable way how we can
    determine whether the audit data we read from 7proc is actually useful.
    Previously we used CAP_AUDIT_CONTROL for this, since nspawn removed that
    from the nspawn container. This has changed a while back however, which
    means we used audit data of host system in the container.
    
    This adds an explicit container check to the audit calls, so that all
    audit data is turned off in containers.
    
    This should fix session creation with pam_systemd/logind in nspawn containers.
    9a3ef988