Rational behind RefuseManualStop=yes in auditd.service

2013-07-30 Thread Laurent Bigonville
Hi, I would like to know the rational behind RefuseManualStop=yes in auditd.service file. I'm currently looking at upgrading the audit package in debian and RefuseManualStop=yes is preventing the daemon to be restarted during upgrade. Looking at systemd.unit(5) manpage, I don't have t

Re: Rational behind RefuseManualStop=yes in auditd.service

2013-07-30 Thread Steve Grubb
On Tuesday, July 30, 2013 10:04:46 PM Laurent Bigonville wrote: > Hi, > > I would like to know the rational behind RefuseManualStop=yes in > auditd.service file. Common Criteria requires that we have the identity of the user altering any audit settings such as whether its ru

Re: Rational behind RefuseManualStop=yes in auditd.service

2013-12-03 Thread Tony Jones
On 07/30/2013 01:25 PM, Steve Grubb wrote: > On Tuesday, July 30, 2013 10:04:46 PM Laurent Bigonville wrote: >> Hi, >> >> I would like to know the rational behind RefuseManualStop=yes in >> auditd.service file. > > The short term "fix" is to force admin

Re: Rational behind RefuseManualStop=yes in auditd.service

2013-12-18 Thread Eric Paris
On Tue, 2013-12-03 at 12:16 -0800, Tony Jones wrote: > On 07/30/2013 01:25 PM, Steve Grubb wrote: > > On Tuesday, July 30, 2013 10:04:46 PM Laurent Bigonville wrote: > >> Hi, > >> > >> I would like to know the rational behind RefuseManualStop=yes in > >

Re: Rational behind RefuseManualStop=yes in auditd.service

2013-12-18 Thread Tony Jones
On 12/18/2013 12:38 PM, Eric Paris wrote: > He made the change in the upstream repo, because that's what you need > for certification purposes. Personally, I hate it, cause i don't give a > hoot about that and would rather things to be consistent, but that's the > rational. A certifiable audit n

Re: Rational behind RefuseManualStop=yes in auditd.service

2013-12-18 Thread Tony Jones
On 12/18/2013 01:07 PM, Tony Jones wrote: > On 12/18/2013 12:38 PM, Eric Paris wrote: > >> He made the change in the upstream repo, because that's what you need >> for certification purposes. Personally, I hate it, cause i don't give a >> hoot about that and would rather things to be consistent,