From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Thu, 2 Jul 2026 20:32:28 +0000 (+0900)
Subject: include: do not override kernel headers with libaudit headers
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0d06dbabc364fe58e4bd1b9696f3c5b823620dbc;p=thirdparty%2Fsystemd.git

include: do not override kernel headers with libaudit headers

Overriding <linux/audit.h> to implicitly include <libaudit.h> turns out to
be problematic. Because <linux/audit.h> is pulled in by various other kernel
headers, any source file including those kernel headers indirectly ends up
depending on <libaudit.h>, even if the executable or library being built
does not require libaudit at all.

Let's drop the override header and include <libaudit.h> only where explicitly
needed. This also moves the fallback definitions of AUDIT_SERVICE_* and
MAX_AUDIT_MESSAGE_LENGTH to libaudit-util.h.
---

diff --git a/src/core/service.c b/src/core/service.c
index 9e4af299f7e..012336b47a0 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <linux/audit.h>        /* IWYU pragma: keep */
 #include <linux/liveupdate.h>
 #include <math.h>
 #include <sys/stat.h>
@@ -36,6 +35,7 @@
 #include "glyph-util.h"
 #include "id128-util.h"
 #include "image-policy.h"
+#include "libaudit-util.h"      /* IWYU pragma: keep */
 #include "log.h"
 #include "luo-util.h"
 #include "manager.h"
diff --git a/src/include/meson.build b/src/include/meson.build
index 9cf7e4dbc88..5fc8bb6a61e 100644
--- a/src/include/meson.build
+++ b/src/include/meson.build
@@ -33,11 +33,6 @@ ipproto_sources = files(
         'uapi/linux/in.h',
 )
 
-# Source files that provides AUDIT_XYZ
-audit_sources = files(
-        'override/linux/audit.h',
-)
-
 # Source files that provides KEY_XYZ
 keyboard_sources = files(
         'uapi/linux/input.h',
diff --git a/src/include/override/linux/audit.h b/src/include/override/linux/audit.h
deleted file mode 100644
index abdd25b3792..00000000000
--- a/src/include/override/linux/audit.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-#include_next <linux/audit.h>   /* IWYU pragma: export */
-
-#if HAVE_AUDIT
-#  include <libaudit.h>         /* IWYU pragma: export */
-#endif
-
-#include <assert.h>
-
-/* We use static_assert() directly here instead of assert_cc()
- * because if we include macro.h in this header, the invocation
- * of generate-audit_type-list.sh becomes more complex.
- */
-
-#ifndef AUDIT_SERVICE_START
-#  define AUDIT_SERVICE_START 1130 /* Service (daemon) start */
-#else
-static_assert(AUDIT_SERVICE_START == 1130, "");
-#endif
-
-#ifndef AUDIT_SERVICE_STOP
-#  define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */
-#else
-static_assert(AUDIT_SERVICE_STOP == 1131, "");
-#endif
-
-#ifndef MAX_AUDIT_MESSAGE_LENGTH
-#  define MAX_AUDIT_MESSAGE_LENGTH 8970
-#else
-static_assert(MAX_AUDIT_MESSAGE_LENGTH == 8970, "");
-#endif
diff --git a/src/journal/audit_type-to-name.awk b/src/journal/audit_type-to-name.awk
index 5dbba45af1b..ef834ff15ea 100644
--- a/src/journal/audit_type-to-name.awk
+++ b/src/journal/audit_type-to-name.awk
@@ -1,6 +1,10 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 BEGIN{
+        print "#if HAVE_AUDIT"
+        print "#  include <libaudit.h>"
+        print "#endif"
+        print ""
         print "#include <linux/audit.h>"
         print ""
         print "#include \"audit-type.h\""
diff --git a/src/journal/journald-manager.c b/src/journal/journald-manager.c
index 68f95ea9678..be3532f1ed5 100644
--- a/src/journal/journald-manager.c
+++ b/src/journal/journald-manager.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <linux/audit.h>
 #include <linux/sockios.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
@@ -47,6 +46,7 @@
 #include "journald-sync.h"
 #include "journald-syslog.h"
 #include "journald-varlink.h"
+#include "libaudit-util.h"
 #include "log.h"
 #include "log-ratelimit.h"
 #include "memory-util.h"
diff --git a/src/journal/meson.build b/src/journal/meson.build
index 5ac4ae2cd07..3579265a119 100644
--- a/src/journal/meson.build
+++ b/src/journal/meson.build
@@ -31,10 +31,19 @@ generated_sources += journald_gperf_c
 systemd_journald_extract_sources += journald_gperf_c
 
 generate_audit_type_list = files('generate-audit_type-list.sh')
+generate_audit_type_command = [env, 'bash', generate_audit_type_list, cpp]
+if libaudit.found()
+        generate_audit_type_command += [
+                '-include', 'libaudit.h',
+                '-I' + libaudit.get_variable('includedir'),
+        ]
+endif
+generate_audit_type_command += system_include_args
+
 audit_type_list_txt = custom_target(
-        input : [generate_audit_type_list, audit_sources],
+        input : [generate_audit_type_list],
         output : 'audit_type-list.txt',
-        command : [env, 'bash', generate_audit_type_list, cpp, system_include_args],
+        command : generate_audit_type_command,
         capture : true)
 
 audit_type_to_name = custom_target(
diff --git a/src/shared/libaudit-util.h b/src/shared/libaudit-util.h
index 8bb05a2fbd3..75cef6f1a04 100644
--- a/src/shared/libaudit-util.h
+++ b/src/shared/libaudit-util.h
@@ -15,6 +15,26 @@ extern DLSYM_PROTOTYPE(audit_log_user_avc_message);
 extern DLSYM_PROTOTYPE(audit_log_user_comm_message);
 #endif
 
+/* libaudit.h defines these constants.
+ * Define them here too so they can be used even when libaudit.h is unavailable. */
+#ifndef AUDIT_SERVICE_START
+#  define AUDIT_SERVICE_START 1130 /* Service (daemon) start */
+#else
+assert_cc(AUDIT_SERVICE_START == 1130);
+#endif
+
+#ifndef AUDIT_SERVICE_STOP
+#  define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */
+#else
+assert_cc(AUDIT_SERVICE_STOP == 1131);
+#endif
+
+#ifndef MAX_AUDIT_MESSAGE_LENGTH
+#  define MAX_AUDIT_MESSAGE_LENGTH 8970
+#else
+assert_cc(MAX_AUDIT_MESSAGE_LENGTH == 8970);
+#endif
+
 bool use_audit(void);
 
 int close_audit_fd(int fd);