talexander/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

audit: build with libcap_ng

Browse Source 
See auditd-plugins(5) for motivation:
> When the audit daemon starts your plugin, you will be running as root.
> If you do not need root privileges, you should change uid/gid to lower
> chances of being a target for exploit. If you need to retain capabilities,
> using libcap-ng is the simplest way.

`libcap_ng` is already in the closure via util-linux and thus does not
unnecessarily bloat the system. It is also a very sane idea to allow
plugins to drop privileges if they already conveniently support it.
This commit is contained in:
Grimmauld 2025-06-25 23:12:13 +02:00
parent 916454f796
commit 4db1e1cf13
No known key found for this signature in database
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkgs/by-name/au/audit/package.nix
View File

@ -10,6 +10,7 @@
python3, python3,
swig, swig,
pkgsCross, pkgsCross,
libcap_ng,
# Enabling python support while cross compiling would be possible, but the # Enabling python support while cross compiling would be possible, but the
# configure script tries executing python to gather info instead of relying on # configure script tries executing python to gather info instead of relying on
@ -78,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
buildInputs = [ buildInputs = [
bash bash
libcap_ng
]; ];
configureFlags = [ configureFlags = [
@ -86,6 +88,9 @@ stdenv.mkDerivation (finalAttrs: {
"--disable-zos-remote" "--disable-zos-remote"
"--with-arm" "--with-arm"
"--with-aarch64" "--with-aarch64"
# capability dropping, currently mostly for plugins as those get spawned as root
# see auditd-plugins(5)
"--with-libcap-ng=yes"
(if enablePython then "--with-python" else "--without-python") (if enablePython then "--with-python" else "--without-python")
]; ];