ansible:如何在centos 7上重新启动auditd服务得到关于依赖的错误

一只晨兴夜不得寐的运维人2024-01-15 12:28

在我的剧本中，我有一个更新 audit.rules 的任务，然后通知应该重新启动 auditd 服务的处理程序。

复制代码 
`task:
  `-` name:  `6.6.7` `-` `audit` `rules` `configuration`
    template: `src=X/ansible/templates/auditd_rules.j2`
              `dest=/etc/audit/rules.d/audit.rules`
              `backup=yes`
              `owner=root` `group=root` `mode=0640`
     notify:
   `-` `restart` `auditd`


  handlers:
    `-` name: `restart` `auditd`
      service: `name=auditd` `state=restarted`
`

当 playbook 运行时，会更新审计规则并请求重新启动 auditd，但这会失败，如下所示。

复制代码 
`RUNNING HANDLER [restart auditd] `************************************************ fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}*

当我查看auditd 的单元定义时，我可以看到rejectManualStop=yes。这就是我无法重新启动服务的原因吗？一个人如何来接受新的审计规则？

复制代码 
` systemctl `cat auditd.service`
`# /usr/lib/systemd/system/auditd.service`
[Unit]
Description=`Security Auditing Service`
DefaultDependencies=`no`
After=`local-fs.target systemd-tmpfiles-setup.service`
Conflicts=`shutdown.target`
Before=`sysinit.target shutdown.target`
RefuseManualStop=`yes`
ConditionKernelCommandLine=`!audit=0`
Documentation=`man:auditd(8) https://people.redhat.com/sgrubb/audit/`

[Service]
ExecStart=`/sbin/auditd -n`
`## To not use augenrules, copy this file to /etc/systemd/system/auditd.service`
`## and comment/delete the next line and uncomment the auditctl line.`
`## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/`
ExecStartPost=`-/sbin/augenrules --load`
`#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules`
ExecReload=`/bin/kill -HUP $MAINPID`
`# By default we don't clear the rules on exit. To enable this, uncomment`
`# the next line after copying the file to /etc/systemd/system/auditd.service`
`#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules`

[Install]
WantedBy=`multi-user.target`
`

最佳答案
这已在 Red Hat Bugzilla #1026648 中进行了探索、讨论和解决(大部分)。和 Anisble Issue # 22171 (github)报告。

分辨率

  • 使用 ansible service模块参数use=service强制执行 /sbin/service实用程序而不是 systemd 的聚集事实值(调用 /sbin/systemctl )像这样:
  • - service: name=auditd state=restarted use=service
  • Example playbook (pastebin.com)
  • 解决方法:
  • 使用 ansible command模块来显式运行服务可执行文件，如下所示:
  • - command: /sbin/service auditd restart
  • 分析------根本原因:
    • This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.
    • It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.
    • RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)
    • Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.

关于ansible:如何在centos 7上重新启动auditd服务得到关于依赖的错误，我们在Stack Overflow上找到一个类似的问题： centos7 - ansible: how to restart auditd service on centos 7 get error about dependency - Stack Overflow
在我的剧本中，我有一个更新 audit.rules 的任务，然后通知应该重新启动 auditd 服务的处理程序。

复制代码 
`task:
  `-` name:  `6.6.7` `-` `audit` `rules` `configuration`
    template: `src=X/ansible/templates/auditd_rules.j2`
              `dest=/etc/audit/rules.d/audit.rules`
              `backup=yes`
              `owner=root` `group=root` `mode=0640`
     notify:
   `-` `restart` `auditd`


  handlers:
    `-` name: `restart` `auditd`
      service: `name=auditd` `state=restarted`
`

当 playbook 运行时，会更新审计规则并请求重新启动 auditd，但这会失败，如下所示。

复制代码 
`RUNNING HANDLER [restart auditd] `************************************************ fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}*

当我查看auditd 的单元定义时，我可以看到rejectManualStop=yes。这就是我无法重新启动服务的原因吗？一个人如何来接受新的审计规则？

复制代码 
` systemctl `cat auditd.service`
`# /usr/lib/systemd/system/auditd.service`
[Unit]
Description=`Security Auditing Service`
DefaultDependencies=`no`
After=`local-fs.target systemd-tmpfiles-setup.service`
Conflicts=`shutdown.target`
Before=`sysinit.target shutdown.target`
RefuseManualStop=`yes`
ConditionKernelCommandLine=`!audit=0`
Documentation=`man:auditd(8) https://people.redhat.com/sgrubb/audit/`

[Service]
ExecStart=`/sbin/auditd -n`
`## To not use augenrules, copy this file to /etc/systemd/system/auditd.service`
`## and comment/delete the next line and uncomment the auditctl line.`
`## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/`
ExecStartPost=`-/sbin/augenrules --load`
`#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules`
ExecReload=`/bin/kill -HUP $MAINPID`
`# By default we don't clear the rules on exit. To enable this, uncomment`
`# the next line after copying the file to /etc/systemd/system/auditd.service`
`#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules`

[Install]
WantedBy=`multi-user.target`
`

最佳答案
这已在 Red Hat Bugzilla #1026648 中进行了探索、讨论和解决(大部分)。和 Anisble Issue # 22171 (github)报告。

分辨率

  • 使用 ansible service模块参数use=service强制执行 /sbin/service实用程序而不是 systemd 的聚集事实值(调用 /sbin/systemctl )像这样:
  • - service: name=auditd state=restarted use=service
  • Example playbook (pastebin.com)
  • 解决方法:
  • 使用 ansible command模块来显式运行服务可执行文件，如下所示:
  • - command: /sbin/service auditd restart
  • 分析------根本原因:
    • This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.
    • It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.
    • RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)
    • Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.

关于ansible:如何在centos 7上重新启动auditd服务得到关于依赖的错误，我们在Stack Overflow上找到一个类似的问题： centos7 - ansible: how to restart auditd service on centos 7 get error about dependency - Stack Overflow
在我的剧本中，我有一个更新 audit.rules 的任务，然后通知应该重新启动 auditd 服务的处理程序。

复制代码 
`task:
  `-` name:  `6.6.7` `-` `audit` `rules` `configuration`
    template: `src=X/ansible/templates/auditd_rules.j2`
              `dest=/etc/audit/rules.d/audit.rules`
              `backup=yes`
              `owner=root` `group=root` `mode=0640`
     notify:
   `-` `restart` `auditd`


  handlers:
    `-` name: `restart` `auditd`
      service: `name=auditd` `state=restarted`
`

当 playbook 运行时，会更新审计规则并请求重新启动 auditd，但这会失败，如下所示。

复制代码 
`RUNNING HANDLER [restart auditd] `************************************************ fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}*

当我查看auditd 的单元定义时，我可以看到RejectManualStop=yes。这就是我无法重新启动服务的原因吗？一个人如何来接受新的审计规则？

复制代码 
` systemctl `cat auditd.service`
`# /usr/lib/systemd/system/auditd.service`
[Unit]
Description=`Security Auditing Service`
DefaultDependencies=`no`
After=`local-fs.target systemd-tmpfiles-setup.service`
Conflicts=`shutdown.target`
Before=`sysinit.target shutdown.target
RefuseManualStop=yes
`ConditionKernelCommandLine=`!audit=0
`Documentation=`man:auditd(8) https://people.redhat.com/sgrubb/audit/`[Service]
ExecStart=`/sbin/auditd -n`
`## To not use augenrules, copy this file to /etc/systemd/system/auditd.service`
`## and comment/delete the next line and uncomment the auditctl line.`
`## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/`
ExecStartPost=`-/sbin/augenrules --load`
`#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules`
ExecReload=`/bin/kill -HUP $MAINPID`
`# By default we don't clear the rules on exit. To enable this, uncomment`
`# the next line after copying the file to /etc/systemd/system/auditd.service`
`#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules`

[Install]
WantedBy=`multi-user.target`
`

最佳答案
这已在 Red Hat Bugzilla #1026648 中进行了探索、讨论和解决(大部分)。和 Anisble Issue # 22171 (github)报告。

分析：

  • 使用 ansible service模块参数use=service强制执行 /sbin/service实用程序而不是 systemd 的聚集事实值(调用 /sbin/systemctl )像这样:
python 复制代码 
- service: name=auditd state=restarted use=service
python 复制代码 
- command: /sbin/service auditd restart

分析------根本原因:

  • This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.
  • It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.
  • RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)
  • Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.

关于ansible:如何在centos 7上重新启动auditd服务得到关于依赖的错误，我们在Stack Overflow上找到一个类似的问题： centos7 - ansible: how to restart auditd service on centos 7 get error about dependency - Stack Overflow

https://stackoverflow.com/questions/41053331/

简单来说就是auditd开发者觉着auditd是系统底层记录日志的服务，不应由管理员重启或停止其服务。

解决方法：

1、使用service auditd restart可以绕过systemctl重启auditd服务。

2、修改systemd服务配置文件/usr/lib/systemd/system/auditd.service配置``RefuseManualStop=No``，执行systemctl deamon-reload。后可以使用systemctl restart auditd

在ansible-play里，1、可以使用command模块代替service模块，重启auditd服务。

  • command: /sbin/service auditd restart

或者2、修改auditd.service配置文件，使systemctl可以管理auditd

相关推荐
Felven1 小时前
stress-ng 与 fio 性能测试工具使用指南
linux·测试工具·fio·stress-ng
huainingning2 小时前
RJ SW Console口忘记密码处理方法
linux·运维·服务器
布裘2 小时前
【银河麒麟】桌面系统循环登录，无法进入桌面？
linux·运维·服务器
慧都小项3 小时前
程序到了Linux才出错？用CLion把调试接到目标环境
linux·运维·服务器
Ruiery5 小时前
Linux 6.6内核内存管理深度解析（一）：物理内存初始化 — memblock 怎么把内存交给 buddy
linux·运维·服务器
天蓝蓝的本我5 小时前
conda日常用到的命令积累1-登录linux，安装pycharm
linux·pycharm·conda
Android系统攻城狮5 小时前
Linux Gstreamer深度解析之gst_audio_encoder_get_frame_max调用流程与实战(五十九)
linux·运维·服务器·gstreamer音视频·音视频进阶·gstreamer音视频进阶
忆挽篱笙歌6 小时前
makefil
linux·运维·服务器
菜_小_白7 小时前
codex
linux·vscode·ai
zhangrelay7 小时前
用ROS2Lyrical实验报告册思路重做蓝桥云课ROS1实验并改进
linux·笔记·学习·ubuntu·机器人
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02历年考研数学一、数学二、数学三真题试卷及答案PDF03Telegram APK 下载安装完整指南 — 2026年最新04如何新建文件夹？ 电脑新建文件夹的4种方法05GitHub 镜像站点06蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接07Windows 10/11 如何退出微软账户并改用本地账户登录（含找不到选项的解决方法）08微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新092026 爱知・名古屋亚运会怎么看？直播平台+赛程安排分享10给AI一张“业务概念地图“：本体如何从哲学走向企业智能