Bug#1038993: audit enabled despite nothing requesting it

[Josh Triplett]

Package: systemd
Version: 253-3
Severity: normal
X-Debbugs-Cc: josh at joshtriplett.org

The NEWS.Debian for the latest version of systemd mentions no longer
disabling audit, and relying on the audit socket being disabled by
default. However, despite that, upgrading systemd seems to have enabled
the audit socket unit:

~$ systemctl | grep audit
  systemd-journald-audit.socket     loaded active running   Journal Audit Socket

And there are a pile of audit messages in dmesg and the journal,
drowning out other messages.

I checked, and no units have Audit=yes, nor does anything appear to
depend on systemd-journald-audit.socket, nor is
systemd-journald-audit.socket included in sockets.target.wants.

- Josh Triplett


-- Package-specific info:

-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: arm64

Kernel: Linux 6.3.0-1-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages systemd depends on:
ii  libacl1            2.3.1-3
ii  libaudit1          1:3.0.9-1
ii  libblkid1          2.38.1-5+b1
ii  libc6              2.36-9
ii  libcap2            1:2.66-4
ii  libcryptsetup12    2:2.6.1-4
ii  libfdisk1          2.38.1-5+b1
ii  libgcrypt20        1.10.2-2
ii  libkmod2           30+20230519-1
ii  liblz4-1           1.9.4-1
ii  liblzma5           5.4.1-0.2
ii  libmount1          2.38.1-5+b1
ii  libp11-kit0        0.24.1-2
ii  libseccomp2        2.5.4-1+b3
ii  libselinux1        3.4-1+b6
ii  libssl3            3.0.9-1
ii  libsystemd-shared  253-3
ii  libsystemd0        253-3
ii  libzstd1           1.5.4+dfsg2-5
ii  mount              2.38.1-5+b1
ii  systemd-dev        253-3

Versions of packages systemd recommends:
ii  dbus [default-dbus-system-bus]   1.14.8-1
ii  systemd-timesyncd [time-daemon]  253-3

Versions of packages systemd suggests:
ii  libfido2-1            1.13.0-1
ii  libqrencode4          4.1.1-1
ii  libtss2-esys-3.0.2-0  3.2.1-3
ii  libtss2-mu0           3.2.1-3
pn  libtss2-rc0           <none>
ii  policykit-1           122-4
ii  polkitd               122-4
pn  systemd-boot          <none>
pn  systemd-container     <none>
pn  systemd-homed         <none>
pn  systemd-resolved      <none>
pn  systemd-userdbd       <none>

Versions of packages systemd is related to:
ii  dbus-user-session  1.14.8-1
pn  dracut             <none>
ii  initramfs-tools    0.142
pn  libnss-systemd     <none>
ii  libpam-systemd     253-3
ii  udev               253-3

-- no debconf information