diff --git a/bosh-stemcell/spec/os_image/ubuntu_spec.rb b/bosh-stemcell/spec/os_image/ubuntu_spec.rb index 73164ce945..17478742d3 100644 --- a/bosh-stemcell/spec/os_image/ubuntu_spec.rb +++ b/bosh-stemcell/spec/os_image/ubuntu_spec.rb @@ -238,9 +238,14 @@ end context "auditd is configured to use augenrules" do - describe file("/etc/systemd/system/auditd.service") do + it "does not create '/etc/systemd/system/auditd.service'" do + expect(File.exist?("/etc/systemd/system/auditd.service")).to eq(false) + end + + describe file("/lib/systemd/system/auditd.service") do it { should be_file } its(:content) { should match(/^ExecStartPost=-\/sbin\/augenrules --load$/) } + its(:content) { should match(/^#ExecStartPost=-\/sbin\/auditctl/) } end end diff --git a/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4 b/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4 index d678317a16..3835f060f8 100644 --- a/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4 +++ b/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4 @@ -1,22 +1,22 @@ - ff2f68b3d31073f864e00366970ae6574f7a98cccce384e97fb5a83ec0b7fea5b304595f7bbfce1a0a5c978c33a1438da9e67130141b770ba450f6350e449cf9 - 656941d3bcf823f63ae269b5e0812c9df2c48fde133fa9119d5868d4f108daf5 - c7ce2218cbdc085a7a49e1d5fd062bf8c77a3a93 - df87851e050b0121e5af52d335ec802d - 435167024 + 4b01c2f0dd1add3cde3292087f90123b733fe4983b5b9f328711cbf122b5bb4ecef46a7a9a63984cbc6ebca40e30629f77123e130b7c6e55c759c109c31db8f2 + 3643e182d29678319c989dabb9ace9a215785b2d29f732904775853dbaa71b59 + 3958f4d0679c50729c0638db2ecbac5dce0e0960 + 4fef24c5144750d091a2f1601e8a204e + 435192936 https://storage.googleapis.com/bosh-os-images/ubuntu-jammy/ubuntu-jammy.tgz - 1079.0.0 + 1080.0.0 - 44018019582146fc17ac3f15c277be6986afd613e481b8483cf41e838fbdfce25520364d6a3fe83400b5b838cd51b720e0484599bccc95e315fc146df1b29931 - 166958059b90ff741397215786f92d69b735a6b7f613f98c4c6b10306ad07445 - 7ca97dd2ef670f4156c38678e7fdcf504a9b4461 - 03de9e337af1c22d0e6cb40a01cc117d - 32713 + be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09 + 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + adc83b19e793491b1c6ea0fd8b46cd9f32e592fc + 68b329da9893e34099c7d8ad5cb9c940 + 1 https://storage.googleapis.com/bosh-os-images/ubuntu-jammy/usn-log.json - 1079.0.0 + 1080.0.0 metalink-repository-resource/0.0.0 - 2026-06-06T14:48:32.085069046Z + 2026-06-08T22:51:23.443948018Z diff --git a/stemcell_builder/stages/bosh_audit_ubuntu/apply.sh b/stemcell_builder/stages/bosh_audit_ubuntu/apply.sh index 5727fffe30..b7e8e59b68 100755 --- a/stemcell_builder/stages/bosh_audit_ubuntu/apply.sh +++ b/stemcell_builder/stages/bosh_audit_ubuntu/apply.sh @@ -8,11 +8,6 @@ source $base_dir/lib/prelude_bosh.bash pkg_mgr install auditd -# Without this, auditd will read from /etc/audit/audit.rules instead -# of /etc/audit/rules.d/*. -cp $chroot/lib/systemd/system/auditd.service $chroot/etc/systemd/system/auditd.service -sed -i '/#ExecStartPost=-\/sbin\/augenrules --load/s/^#//g' $chroot/etc/systemd/system/auditd.service -sed -i '/ExecStartPost=-\/sbin\/auditctl -R \/etc\/audit\/audit.rules/s/^/#/g' $chroot/etc/systemd/system/auditd.service run_in_bosh_chroot $chroot "systemctl disable auditd.service" run_in_bosh_chroot $chroot "chown root:root /var/log/audit" # (stig: V-38663) (stig: V-38664) (stig: V-38665)