add restart-auditd handler after configuration change

[rndmh3ro]

(e.g. of os_auditd_max_log_file_action) you need to restart. Sadly on rhel7 systems you cannot use systemd. And as debian derivates use service as alias and it works I kept it that simple. also adding 'auditd'-tag to make it easy only run that config change if needed.

Signed-off-by: Felix Herzog snoopotic@gmail.com

This is a copy of PR #260, because the other one was too hard to rebase.

[schurzi]

Trying to restart Audit breaks our CI, because Auditd can not be started inside a container. Maybe exclude Audit from CI configuration?

Messages from Logfile:

-- Subject: Unit auditd.service has begun start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit auditd.service has begun starting up.
Mar 21 13:53:01 27d95dece8d6 auditd[2297]: The disp_qos option is deprecated - line 13
Mar 21 13:53:01 27d95dece8d6 auditd[2297]: The dispatcher option is deprecated - line 14
Mar 21 13:53:01 27d95dece8d6 auditd[2297]: Cannot change priority (Operation not permitted)
Mar 21 13:53:01 27d95dece8d6 auditd[2297]: The audit daemon is exiting.
Mar 21 13:53:01 27d95dece8d6 systemd[1]: auditd.service: Control process exited, code=exited status=1
Mar 21 13:53:01 27d95dece8d6 systemd[1]: auditd.service: Failed with result 'exit-code'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- The unit auditd.service has entered the 'failed' state with result 'exit-code'.
Mar 21 13:53:01 27d95dece8d6 systemd[1]: Failed to start Security Auditing Service.
-- Subject: Unit auditd.service has failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit auditd.service has failed.
--
-- The result is failed.
Mar 21 13:56:07 27d95dece8d6 systemd[1]: Starting Security Auditing Service...
-- Subject: Unit auditd.service has begun start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit auditd.service has begun starting up.
Mar 21 13:56:07 27d95dece8d6 auditd[2333]: The disp_qos option is deprecated - line 13
Mar 21 13:56:07 27d95dece8d6 auditd[2333]: The dispatcher option is deprecated - line 14
Mar 21 13:56:07 27d95dece8d6 auditd[2334]: Error - audit support not in kernel
Mar 21 13:56:07 27d95dece8d6 auditd[2334]: Cannot open netlink audit socket
Mar 21 13:56:07 27d95dece8d6 auditd[2334]: The audit daemon is exiting.
Mar 21 13:56:07 27d95dece8d6 auditd[2333]: Cannot daemonize (Success)
Mar 21 13:56:07 27d95dece8d6 auditd[2333]: The audit daemon is exiting.
Mar 21 13:56:07 27d95dece8d6 systemd[1]: auditd.service: Control process exited, code=exited status=1
Mar 21 13:56:07 27d95dece8d6 systemd[1]: auditd.service: Failed with result 'exit-code'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- The unit auditd.service has entered the 'failed' state with result 'exit-code'.
Mar 21 13:56:07 27d95dece8d6 systemd[1]: Failed to start Security Auditing Service.
-- Subject: Unit auditd.service has failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit auditd.service has failed.
--
-- The result is failed.