ansible:如何在centos 7上重新启动auditd服务得到关于依赖的错误-Toy模板网

这篇具有很好参考价值的文章主要介绍了ansible:如何在centos 7上重新启动auditd服务得到关于依赖的错误。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

在我的剧本中，我有一个更新 audit.rules 的任务，然后通知应该重新启动 auditd 服务的处理程序。

task:
  - name:  6.6.7 - audit rules configuration
    template: src=X/ansible/templates/auditd_rules.j2
              dest=/etc/audit/rules.d/audit.rules
              backup=yes
              owner=root group=root mode=0640
     notify:
   - restart auditd


  handlers:
    - name: restart auditd
      service: name=auditd state=restarted

当 playbook 运行时，会更新审计规则并请求重新启动 auditd，但这会失败，如下所示。

RUNNING HANDLER [restart auditd] *********************************************** fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}

当我查看auditd 的单元定义时，我可以看到rejectManualStop=yes。这就是我无法重新启动服务的原因吗？一个人如何来接受新的审计规则？

 systemctl cat auditd.service
# /usr/lib/systemd/system/auditd.service
[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules

[Install]
WantedBy=multi-user.target

最佳答案

这已在 Red Hat Bugzilla #1026648 中进行了探索、讨论和解决(大部分)。和 Anisble Issue # 22171 (github)报告。

分辨率

使用 ansible service模块参数use=service强制执行 /sbin/service实用程序而不是 systemd 的聚集事实值(调用 /sbin/systemctl )像这样:
- service: name=auditd state=restarted use=service
Example playbook (pastebin.com)
解决方法:
使用 ansible command模块来显式运行服务可执行文件，如下所示:
- command: /sbin/service auditd restart
分析——根本原因:
- This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.
- It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.
- RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)
- Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.

关于ansible:如何在centos 7上重新启动auditd服务得到关于依赖的错误，我们在Stack Overflow上找到一个类似的问题： centos7 - ansible: how to restart auditd service on centos 7 get error about dependency - Stack Overflow

在我的剧本中，我有一个更新 audit.rules 的任务，然后通知应该重新启动 auditd 服务的处理程序。

task:
  - name:  6.6.7 - audit rules configuration
    template: src=X/ansible/templates/auditd_rules.j2
              dest=/etc/audit/rules.d/audit.rules
              backup=yes
              owner=root group=root mode=0640
     notify:
   - restart auditd


  handlers:
    - name: restart auditd
      service: name=auditd state=restarted

当 playbook 运行时，会更新审计规则并请求重新启动 auditd，但这会失败，如下所示。

RUNNING HANDLER [restart auditd] *********************************************** fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}

当我查看auditd 的单元定义时，我可以看到rejectManualStop=yes。这就是我无法重新启动服务的原因吗？一个人如何来接受新的审计规则？

 systemctl cat auditd.service
# /usr/lib/systemd/system/auditd.service
[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules

[Install]
WantedBy=multi-user.target

最佳答案

这已在 Red Hat Bugzilla #1026648 中进行了探索、讨论和解决(大部分)。和 Anisble Issue # 22171 (github)报告。

分辨率

使用 ansible service模块参数use=service强制执行 /sbin/service实用程序而不是 systemd 的聚集事实值(调用 /sbin/systemctl )像这样:
- service: name=auditd state=restarted use=service
Example playbook (pastebin.com)
解决方法:
使用 ansible command模块来显式运行服务可执行文件，如下所示:
- command: /sbin/service auditd restart
分析——根本原因:
- This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.
- It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.
- RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)
- Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.

在我的剧本中，我有一个更新 audit.rules 的任务，然后通知应该重新启动 auditd 服务的处理程序。

task:
  - name:  6.6.7 - audit rules configuration
    template: src=X/ansible/templates/auditd_rules.j2
              dest=/etc/audit/rules.d/audit.rules
              backup=yes
              owner=root group=root mode=0640
     notify:
   - restart auditd


  handlers:
    - name: restart auditd
      service: name=auditd state=restarted

当 playbook 运行时，会更新审计规则并请求重新启动 auditd，但这会失败，如下所示。

RUNNING HANDLER [restart auditd] *********************************************** fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}

当我查看auditd 的单元定义时，我可以看到RejectManualStop=yes。这就是我无法重新启动服务的原因吗？一个人如何来接受新的审计规则？

 systemctl cat auditd.service
# /usr/lib/systemd/system/auditd.service
[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules

[Install]
WantedBy=multi-user.target

最佳答案

这已在 Red Hat Bugzilla #1026648 中进行了探索、讨论和解决(大部分)。和 Anisble Issue # 22171 (github)报告。

分析：

使用 ansible service模块参数use=service强制执行 /sbin/service实用程序而不是 systemd 的聚集事实值(调用 /sbin/systemctl )像这样:

- service: name=auditd state=restarted use=service

Example playbook (pastebin.com)
解决方法:
使用 ansible command模块来显式运行服务可执行文件，如下所示:

- command: /sbin/service auditd restart

分析——根本原因:

This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.

It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.

RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)

Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.