3

How do I disable sudo inside of LXC containers from writing to the audit log on the host?

Both the host and containers are Fedora 29. We run many containers running automated tests. Some of those containers run many invocations of sudo which appear in the audit log on the host filling up the output of journalctl. Currently, it is representing 95% of the output in journalctl and causing it to truncate to less than 24 hours prior.

I have looked at sudo's configuration and it appears to have an audit plugin, but it is unclear how to just disable that one plugin in sudo.conf. I would also prefer to not have to modify files in all containers that other users might be using.

More likely, I would prefer to just disable the audit logging from LXC containers to the host. I was looking at auditctl to create rules to disable certain messages, but it appeared to be system-wide. I don't want to disable the host from logging sudo access or other event, but I don't care what happens inside a container. How can I just filter on the sudo messages (or all messages) when coming from a container?

1 Answer 1

0

I think these threads can help you:

How to disable sudo related logging for successful command execution under CentOS/Fedora?

https://stackoverflow.com/questions/14277116/suppress-log-entry-for-single-sudo-commands

In resume:

You can disable sudo related log messages overriding the system defaults:

Defaults:john         !syslog

or even more restrict:

Defaults:john         !syslog, !pam_session
1
  • Welcome to the site, and thank you for your contribution. Please note that link-only answers are discouraged, as the link may become invalid or the linked content change. Please edit your answer to include at least a summary of the linked explanation.
    – AdminBee
    Jan 14, 2021 at 8:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .