28c0abcebb
It's faster and more reliable to wait_for_pids than to sleep 1. cem@ suggested just to remove auditd_stop() and use the rc.subr default stop action (SIGTERM instead of audit -t), which has a built-in wait_for_pids. That may be a better solution. Discussed with: cem Reviewed by: asomers Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D23223
36 lines
587 B
Bash
Executable File
36 lines
587 B
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# $FreeBSD$
|
|
#
|
|
# Start up for the Audit daemon.
|
|
#
|
|
|
|
# PROVIDE: auditd
|
|
# REQUIRE: syslogd
|
|
# BEFORE: DAEMON
|
|
# KEYWORD: nojail shutdown
|
|
|
|
. /etc/rc.subr
|
|
|
|
name="auditd"
|
|
desc="Audit daemon"
|
|
stop_cmd="auditd_stop"
|
|
command="/usr/sbin/${name}"
|
|
rcvar="auditd_enable"
|
|
command_args="${auditd_flags}"
|
|
required_files="/etc/security/audit_class /etc/security/audit_control
|
|
/etc/security/audit_event /etc/security/audit_user
|
|
/etc/security/audit_warn"
|
|
|
|
auditd_stop()
|
|
{
|
|
|
|
/usr/sbin/audit -t
|
|
if [ -n "$rc_pid" ]; then
|
|
wait_for_pids $rc_pid
|
|
fi
|
|
}
|
|
|
|
load_rc_config $name
|
|
run_rc_command "$1"
|