The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see
https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for
details. This caused all audit log messages to be logged in LOG_USER.
Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT()
to match RFC5424 terminology.
Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING.
Additionally, drop the leading [severity] prefix to sysrepo logs. Only
needed when logging to stdout.
Follow-up to issue #521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When sysrepo-plugind is processing callback events, make sure to log the
error and exit(1) the entire process so the system can handle the problem.
For example, restart all dependent services.
Fixes#585
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces a new SECURITY() log macro that logs to facility
'audit' (sometimes called 'security') with severity set to 'alert'. It
is then used to instrument the single most important things to log; all
changes to users and their privileges.
We also add logging to sysrepo, which knows the username for changes to
running-config, copies to startup-config, and RPCs.
Fixes#521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For netopeer2 we need to patch away local-users, since if it is enabled
netopeer2 requires all users that should be allowed to use netconf to
also be configured in ietf-netconf-server.
Also add some upstream patches.
This also adds support in sysrepot to install factory config on boot,
default is only to allow it when installing the module, we can not do
that anymore, since the modules is installed during build and the factory
config (or failure) can only be determed when booted.
This local patch of sysrepo adds support for detecting non-zero return
code from sysrepo callbacks during SR_EV_DONE, which upstream sysrepo
currently, as of v2.2.105, discards.
With this change failure to load startup-config results in the system
detecting the failure applying failure-config instead.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport upstream sysrepo support for initializing internal modules,
like ietf-netconf-acm, with factory-default data.
A local KernelKit patch on top is required for run-time loading from
/etc/sysrepo/factory-default.json instead of the upsream compile-time
support.
Renamed existing patches to maintain the proper patch order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This changeset includes a patch to the upstream sysrepo that is a slight
refactor of the internal function sr_install_modules_prepare_mod() that
is used by sr_install_module2(). Meaning, the srx_require_module() can
now be simplified greatly and we now also support the include statement
with submodules in yang models.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mattias Walström