Enable system audit logs

[randomvariable]

Many environments require the use of auditd, so this should be enabled in image-builder, optionally or mandatorily:

Concretely, for PhotonOS images require the audit package to be installed, and the auditd systemd unit enabled.

Additionally, drop the following in /etc/audit/rules.d/container.rules so containerd operations are audited:

-w /usr/local/bin/containerd -p rwxa -k containerd
-w /var/lib/containerd/ -p rwxa -k containerd
-w /etc/containerd/ -p rwxa -k containerd
-w /etc/systemd/system/containerd.service -p rwxa -k containerd
-w /etc/systemd/system/containerd.service.d/ -p rwxa -k containerd
-w /run/containerd/ -p rwxa -k containerd
-w /usr/local/bin/containerd-shim -p rwxa -k containerd
-w /usr/local/bin/containerd-shim-runc-v1 -p rwxa -k containerd
-w /usr/local/bin/containerd-shim-runc-v2 -p rwxa -k containerd
-w /usr/local/sbin/runc -p rwxa -k containerd

[EleanorRigby]

#271

@codenrhoden : we can close this as this was merged yesterday

[codenrhoden]

/close

[k8s-ci-robot]

@codenrhoden: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.