diff --git a/jobs/auditd/spec b/jobs/auditd/spec index 5ea1415..726fd96 100644 --- a/jobs/auditd/spec +++ b/jobs/auditd/spec @@ -12,3 +12,7 @@ properties: default: [] example: - "-a always,exit -F perm=x -F auid>=500 -F auid!=4294967295 -F path=/usr/bin/who -k privileged" + pre_start_delay: + description: The number of seconds to delay running the pre-start script. This can be used, for example, to avoid a race condition with other pre-start scripts, such as IPsec's, that can prevent auditd From starting + default: 0 + example: 30 diff --git a/jobs/auditd/templates/pre-start b/jobs/auditd/templates/pre-start index 9b8f4f9..b76b940 100644 --- a/jobs/auditd/templates/pre-start +++ b/jobs/auditd/templates/pre-start @@ -1,5 +1,12 @@ #!/bin/bash +set -xeu -o pipefail + +date +echo Delaying start for '<%= p("pre_start_delay") %>' seconds +sleep '<%= p("pre_start_delay") %>' +date + if ! grep -e '^-e 2$' /etc/audit/rules.d/audit.rules -q; then echo ' # Custom rules; added by auditd job (os-conf-release)