<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div>
<span style="font-family: monospace"><span style="color: #000000 ; background-color: #ffffff">This fixes an issue within journald aborting when running inside</span> <br />archlinux container via systemd-nspawn on a debian host with audit <br />enabled kernel.
<br />
<br />The journald binary in the archlinux container would try to bind an <br />audit netlink socket which isn't allowed from within containers. <br />The failed bind call then leads to a abort of journald which in turn <br />disables logging
for the whole container.
<br />
<br />This commit fixes this by logging and ignoring the EPERM error raised <br />from the kernel after the bind call if it detects that it's running <br />inside a container.
<br />---
<br /> src/journal/journald-audit.c | 8 +++++++-
<br /> src/journal/journald-server.c | 2 ++
<br /> 2 files changed, 9 insertions(+), 1 deletion(-)
<br />
<br />diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c
<br />index 46eb82f..1b36984 100644
<br />--- a/src/journal/journald-audit.c
<br />+++ b/src/journal/journald-audit.c
<br />@@ -20,6 +20,7 @@
<br /> ***/
<br />
<br /> #include "missing.h"
<br />+#include "virt.h"
<br /> #include "journald-audit.h"
<br />
<br /> typedef struct MapField {
<br />@@ -533,8 +534,13 @@ int server_open_audit(Server *s) {
<br /> }
<br />
<br /> r = bind(s->audit_fd, &<a href="http://sa.sa" target="_blank">http://sa.sa</a>, sizeof(<a href="http://sa.nl)" target="_blank">http://sa.nl)</a>);
<br />- if (r < 0)
<br />+ if (r < 0) {
<br />+ if (errno == EPERM && detect_container(NULL) > 0) {
<br />+ log_debug("Audit not supported in containers.");
<br />+ return 0;
<br />+ }
<br /> return log_error_errno(errno, "Failed to join audit multicast group: %m");
<br />+ }
<br /> } else
<br /> fd_nonblock(s->audit_fd, 1);
<br />
<br />diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
<br />index 5e07ce3..21f383a 100644
<br />--- a/src/journal/journald-server.c
<br />+++ b/src/journal/journald-server.c
<br />@@ -1585,9 +1585,11 @@ int server_init(Server *s) {
<br /> if (r < 0)
<br /> return r;
<br />
<br />+#ifdef HAVE_AUDIT
<br /> r = server_open_audit(s);
<br /> if (r < 0)
<br /> return r;
<br />+#endif
<br />
<br /> r = server_open_kernel_seqnum(s);
<br /> if (r < 0)
<br />--
<br />2.3.5<br /></span></div> </body>
</html>