update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Freenode.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/1646015/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

Hi

See the resul below. when try audit

root@8a135f3b1d8e:/# apt-get install audit
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Unable to locate package audit

Hi

Still no update on this issue ??? Please guide how to solve the same.

Does it make sense to install auditd in a container?

Thanks

On Thu, Dec 01, 2016 at 04:53:12AM -0000, niraj vara wrote:
> See the resul below. when try audit
>
> root@8a135f3b1d8e:/# apt-get install audit
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> E: Unable to locate package audit

Niraj, the binary package is named 'auditd', only the source package
name is 'audit'. You'll need to do 'apt-get install auditd' instead.

--
Steve Beattie
<email address hidden>
http://NxNW.org/~steve/

HI

I have did the same command earlier
apt-get install auditd

the error was above my first post. In starting of the thread I have post the error.

Hi @seth

   Audit we installed for the all activity monitor log. For container also we want log the all the activity log so I anything goes wrong with container we can trace something.

HI

Please guide how to solve this issue.

Niraj, it looks like work was done to make running auditd in containers actually make sense: https://bugzilla.redhat.com/show_bug.cgi?id=893751

What parts of the work are we missing, if any?

Thanks

HI

bug 893751 link I checked and shows some solution and given some patches files but that files not available in both host and container.

suggest some systemd related patches but below files not found anywhere to apply the patches.

README
man/systemd-nspawn.xml
src/nspawn/nspawn.c

other provide the audit kernel patches and that patches files also not found in container.

include/uapi/linux/audit.h
kernel/audit.c
kernel/auditsc.

Please guide to solve the issue.

Hi

Waiting for the reply.

I have the same problem, trying to install docker inside a docker image of Ubuntu 16.04 and following instructions at: https://docs.docker.com/engine/installation/linux/ubuntu
If there is another way to achieve this task or fundamental reasons for not even trying, please let me know.

Status changed to 'Confirmed' because the bug affects multiple users.

I'm wondering what is the issue here.

The "update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults" warning is completely harmless.

Is anything broken in addition to this warning?

Hi Laurent, the issue is from this line:

invoke-rc.d: policy-rc.d denied execution of start.

Until the work from https://bugzilla.redhat.com/show_bug.cgi?id=893751 lands it doesn't make sense to run multiple auditds on one kernel. Someone needs to do the work to see how much we're missing. So far I don't think anyone has offered to undertake the research to enable this.

Thanks

"invoke-rc.d: policy-rc.d denied execution of start." is more than probably coming from /usr/sbin/policy-rc.d that is something managed by the user (or apparently after some quick googling, used in docker containers). AFAICT this has nothing to do with the lack audit support in containers.

The RH bug you mentioned is quite old, was this tested again?

This bug was fixed in the package audit - 1:2.7.7-1ubuntu1

---------------
audit (1:2.7.7-1ubuntu1) artful; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/rules: Disable auditd network listener, with --disable-listener,
      to reduce the risk of a remote attack on auditd, which runs as root

audit (1:2.7.7-1) unstable; urgency=medium

  * New upstream release
    - Drop debian/patches/03-fix-segfault-sock.patch, applied upstream
    - Refresh debian/patches/01-no-refusemanualstop.patch
    - debian/libaudit1.symbols, debian/libauparse0.symbols: Update the
      exported symbols list
  * debian/control: Bump Standards-Version to 4.0.0 (no further changes)
  * debian/rules: Do not pass start/stop options to update-rc.d, this is
    deprecated for years and just produces a confusing warning (Closes:
    #860217, LP: #1646015)

audit (1:2.6.7-2) unstable; urgency=medium

  [ Laurent Bigonville ]
  * debian/patches/03-fix-segfault-sock.patch: Fix ausearch segfault caused by
    some audit messages (Closes: #859120)

  [ Helmut Grohne ]
  * Fix FTCBFS: Cross compatible python Build-Depends (Closes: #840896)
  * Add support for the nopython build profile (Closes: #840262)

audit (1:2.6.7-1) unstable; urgency=medium

  * New upstream release
    - debian/patches/02-restorecon-path.patch: Fix restorecon path
    - debian/libauparse0.symbols: Drop au_terminate_all_events symbol, it was
      never part of the public API
  * debian/*.symbols: Add the Build-Depends-Package field

 -- Steve Langasek <email address hidden> Sun, 02 Jul 2017 22:20:22 -0700