On Sat, 24 Jun 2023 00:38:16 -0700 Josh Triplett <j...@joshtriplett.org> wrote: > Package: systemd > Version: 253-3 > Severity: normal > X-Debbugs-Cc: j...@joshtriplett.org > > The NEWS.Debian for the latest version of systemd mentions no longer > disabling audit, and relying on the audit socket being disabled by > default. However, despite that, upgrading systemd seems to have enabled > the audit socket unit: > > ~$ systemctl | grep audit > systemd-journald-audit.socket loaded active running Journal Audit Socket > > And there are a pile of audit messages in dmesg and the journal, > drowning out other messages. > > I checked, and no units have Audit=yes, nor does anything appear to > depend on systemd-journald-audit.socket, nor is > systemd-journald-audit.socket included in sockets.target.wants.
Turns out we overlooked one thing - systemd-journald.service lists the audit socket under Sockets=, but that adds an implicit Wants, so effectively it is always activated automatically. -- Kind regards, Luca Boccassi
signature.asc
Description: This is a digitally signed message part
