;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2019 Danny Milosavljevic <dannym@scratchpost.org>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu services auditd)
  #:use-module (gnu services)
  #:use-module (gnu services configuration)
  #:use-module (gnu services base)
  #:use-module (gnu services shepherd)
  #:use-module (gnu packages admin)
  #:use-module (guix records)
  #:use-module (guix gexp)
  #:use-module (guix packages)
  #:export (auditd-configuration
            auditd-service-type))

; /etc/audit/audit.rules

(define-configuration auditd-configuration
  (audit
   (package audit)
   "Audit package."))

(define (auditd-shepherd-service config)
  (let* ((audit (auditd-configuration-audit config)))
    (list (shepherd-service
           (documentation "Auditd allows you to audit file system accesses.")
           (provision '(auditd))
           (start #~(make-forkexec-constructor
                     (list (string-append #$audit "/sbin/auditd"))))
           (stop #~(make-kill-destructor))))))

(define auditd-service-type
  (service-type (name 'auditd)
                (description "Allows auditing file system accesses.")
                (extensions
                 (list
                  (service-extension shepherd-root-service-type
                                     auditd-shepherd-service)))
                (default-value (auditd-configuration))))
r></table>
<div class='path'>path: <a href='/guix/log/?id=8bd0632a02c84ff6ca4e3fc3708657633ec10f08'>root</a>/<a href='/guix/log/tests?id=8bd0632a02c84ff6ca4e3fc3708657633ec10f08'>tests</a>/<a href='/guix/log/tests/guix-authenticate.sh?id=8bd0632a02c84ff6ca4e3fc3708657633ec10f08'>guix-authenticate.sh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/guix-authenticate.sh?id=8bd0632a02c84ff6ca4e3fc3708657633ec10f08&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-09-15 14:40:20 +0200'>2020-09-15</span></td><td><a href='/guix/commit/tests/guix-authenticate.sh?id=b911d6547444b5f8d17b224bafa5ee1b5aafaff5'>authenticate: Encode strings as ISO-8859-1.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://bugs.gnu.org/43421&gt;.

* guix/scripts/authenticate.scm (read-command): Decode strings as
ISO-8859-1, not UTF-8.
(guix-authenticate)[send-reply]: Encode strings as ISO-8859-1, not
UTF-8.
* tests/guix-authenticate.sh: Add test.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-14 15:42:55 +0200'>2020-09-14</span></td><td><a href='/guix/commit/tests/guix-authenticate.sh?id=64cf660f872fb7aaf0d2b463e45b4c756297f743'>daemon: Spawn 'guix authenticate' once for all.</a><span class='msg-avail'>...<span class='msg-tooltip'>Previously, we'd spawn 'guix authenticate' once for each item that has
to be signed (when exporting) or authenticated (when importing).  Now,
we spawn it once for all and then follow a request/reply protocol.  This
reduces the wall-clock time of:

  guix archive --export -r $(guix build coreutils -d)

from 30s to 2s.

* guix/scripts/authenticate.scm (sign-with-key): Return the signature
instead of displaying it.  Raise a &amp;formatted-message instead of calling
'leave'.
(validate-signature): Likewise.
(read-command): New procedure.
(define-enumerate-type, reply-code): New macros.
(guix-authenticate)[send-reply]: New procedure.
Change to read commands from current-input-port.
* nix/libstore/local-store.cc (runAuthenticationProgram): Remove.
(authenticationAgent, readInteger, readAuthenticateReply): New
functions.
(signHash, verifySignature): Rewrite in terms of the agent.
* tests/store.scm ("import not signed"): Remove 'pk' call.
("import signed by unauthorized key"): Check the error message of C.
* tests/guix-authenticate.sh: Rewrite using the new protocol.

fixlet
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-11 17:53:58 +0200'>2020-09-11</span></td><td><a href='/guix/commit/tests/guix-authenticate.sh?id=6dd8ffc57420ee2f6f19e79e41028e78fe9e6a7e'>daemon: Simplify interface with 'guix authenticate'.</a><span class='msg-avail'>...<span class='msg-tooltip'>There's no reason at this point to mimic the calling convention of the
'openssl' command.

* nix/libstore/local-store.cc (LocalStore::exportPath): Add only "sign"
and HASH to ARGS.  Remove 'tmpDir' and 'hashFile'.
(LocalStore::importPath): Add only "verify" and SIGNATURE to
* guix/scripts/authenticate.scm (guix-authenticate): Adjust
accordingly; remove the OpenSSL-style clauses.
(read-hash-data): Remove.
(sign-with-key): Replace 'port' with 'sha256' and adjust accordingly.
(validate-signature): Export SIGNATURE to be a canonical sexp.
* tests/guix-authenticate.sh: Adjust tests accordingly.
</span></span></td><td>Ludovic Courtès</td></tr>