Since CoreOs 766, the auditing subsystem is partially integrated:
The audit subsystem has been enabled in the kernel and auditctl added to the image. Most audit events are ignored by default. The audit rules may be modified in /etc/audit/rules.d. Note that auditd is not included, journald is responsible for logging events instead although it is a best effort mechanism. Unlike with auditd based systems the kernel will not panic if journald fails to record an event for some reason.
I have tried the following in order to audit syscalls on both 899 and alpha 1000 CoreOs releases.
# starting a new periodic process:
$ while true; do echo "coreos ..." > /tmp/a.txt && sleep 5s; done &
[1] 4509
# get its pid and add a new audit rule:
$ sudo auditctl -a always,exit -F arch=b64 -S read,write,close,dup2,wait4 -F pid=4509
# wait 5 minutes and check if any audit related event was logged into by the journald:
$ journalctl | grep audit | wc
0 0 0
Why can't I see any event that's logged by the journald?
The cn.ko is loaded properly and according the auditctl -l output the rule is set successfully. Though it looks like journald doesn't receive messages from the netlink interface.
I followed the following steps in order to enable debugging but it didn't give any hints either:
mkdir -p /etc/systemd/system/systemd-journald.service.d/
vim /etc/systemd/system/systemd-journald.service.d/10-debug.conf and filled it with following content:
[Service]
Environment=SYSTEMD_LOG_LEVEL=debug
And restart systemd-journald service:
systemctl daemon-reload
systemctl restart systemd-journald
dmesg | grep systemd-journald
