LXC Audit Support

liberodark

Member
Apr 26, 2021
105
21
23
31
Hi,

Im trying to run auditd or go-audit on LXC but have issue with :

With auditd :
Code:
sudo: unable to send audit message: Operation not permitted
You must be root to run this program.

With go-audit :
Code:
Failed to flush existing audit rules. Error: exit status 4

Have adding this options but that not work
Code:
lxc.apparmor.profile: unconfined
lxc.cap.drop: audit_control audit_write

If you have any idea about this ?

PS : I think best solution is to audit PVE Node directly i can see what user and ct have running software.

Best Regards
 
Last edited:

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!