Networkmanager without auditd?

[GaVenga]

Auditd is a dependency of networkmanager
BUT not needed (?)
What about to change auditd to optional dependecy?
Reason (journald):
(NetworkManager[894]: <error> [1763220495.4485] audit: failed to open auditd socket: Protocol not supported)

[Aragorn]

@GaVenga

Auditd is a dependency of networkmanager
BUT not needed (?)

It’s required by a lot more than NetworkManager. It’s also a requirement for systemd, dbus, shadow, and several other packages.

[Nachlese]

As far as I know, it is only a make dependency (has to be present when the package is built).

I have disabled the audit framework since like forever, with the kernel command line parameter:
audit=0

Audit framework - ArchWiki

[GaVenga]

@Nachlese

I have disabled the audit framework

Me too.
Additionally I masked “all (3)” entries in (system) systemd.
The protocol entry still appears (sometimes) - netsearch says “ignore this”;
I’m not clear on what caused the message, or whether it’s truly harmless.
Or are the aliens/allies curious?

[Nachlese]

this is all I see in my logs

journalctl -b0 | grep audit
Nov 16 11:28:14 jo-xfce kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-6.12-x86_64 root=UUID=4c28c9c0-39c7-4aac-830f-034e92278642 rw mitigations=off quiet udev.log_priority=3 audit=0
Nov 16 11:28:14 jo-xfce kernel: Kernel command line: BOOT_IMAGE=/boot/vmlinuz-6.12-x86_64 root=UUID=4c28c9c0-39c7-4aac-830f-034e92278642 rw mitigations=off quiet udev.log_priority=3 audit=0
Nov 16 11:28:14 jo-xfce kernel: audit: disabled (until reboot)
Nov 16 11:28:14 jo-xfce systemd-journald[265]: Collecting audit messages is disabled.
Nov 16 11:30:49 jo-xfce lightdm[550]: Error opening audit socket: Protocol not supported

Virtual machine, audit only disabled via kernel command line, since it can’t be deinstalled because of dependencies.
I didn’t mask anything.
The Arch wiki only mentions one place, not three:

Note
In order to disable audit completely and suppress audit messages from appearing in journal you may set audit=0 as kernel parameter and/or mask systemd-journald-audit.socket.

[GaVenga]

@Nachlese

only mentions one place

however, in the imagination of an AI search engine, there are three..
The result however, it is the same as if I mask the socket only.
==> “Much helps much” <== my beloved paranoia…