summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--README7
-rw-r--r--man/systemd-nspawn.xml15
-rw-r--r--src/nspawn/nspawn.c19
3 files changed, 35 insertions, 6 deletions
diff --git a/README b/README
index b8d1f42e25..3cd93f01f4 100644
--- a/README
+++ b/README
@@ -79,6 +79,13 @@ REQUIREMENTS:
CONFIG_EFI_VARS
CONFIG_EFI_PARTITION
+ Note that kernel auditing is broken when used with systemd's
+ container code. When using systemd in conjunction with
+ containers please make sure to either turn off auditing at
+ runtime using the kernel command line option "audit=0", or
+ turn it off at kernel compile time using:
+ CONFIG_AUDIT=n
+
dbus >= 1.4.0
libcap
libblkid >= 2.20 (from util-linux) (optional)
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index d9fb899895..1bc61e83a7 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -142,16 +142,19 @@
might be necessary to add this file to the container
tree manually if the OS of the container is too old to
contain this file out-of-the-box.</para>
+ </refsect1>
+
+ <refsect1>
+ <title>Incompatibility with Auditing</title>
<para>Note that the kernel auditing subsystem is
currently broken when used together with
containers. We hence recommend turning it off entirely
- when using <command>systemd-nspawn</command> by
- booting with <literal>audit=0</literal> on the kernel
- command line, or by turning it off at kernel build
- time. If auditing is enabled in the kernel operating
- systems booted in an nspawn container might refuse
- log-in attempts.</para>
+ by booting with <literal>audit=0</literal> on the
+ kernel command line, or by turning it off at kernel
+ build time. If auditing is enabled in the kernel
+ operating systems booted in an nspawn container might
+ refuse log-in attempts.</para>
</refsect1>
<refsect1>
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 09153c87ce..b91b0b8a91 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -1219,6 +1219,18 @@ finish:
return r;
}
+static bool audit_enabled(void) {
+ int fd;
+
+ fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
+ if (fd >= 0) {
+ close_nointr_nofail(fd);
+ return true;
+ }
+
+ return false;
+}
+
int main(int argc, char *argv[]) {
pid_t pid = 0;
int r = EXIT_FAILURE, k;
@@ -1284,6 +1296,13 @@ int main(int argc, char *argv[]) {
goto finish;
}
+ if (audit_enabled()) {
+ log_warning("The kernel auditing subsystem is known to be incompatible with containers.\n"
+ "Please make sure to turn off auditing with 'audit=0' on the kernel command\n"
+ "line before using systemd-nspawn. Sleeping for 5s...\n");
+ sleep(5);
+ }
+
if (path_equal(arg_directory, "/")) {
log_error("Spawning container on root directory not supported.");
goto finish;