fix: auditd failed to start

Containerfile

@@ -38,6 +38,7 @@ RUN sed -i 's/#AutomaticUpdatePolicy.*/AutomaticUpdatePolicy=stage/' /etc/rpm-os
     sed -i 's/#DefaultTimeoutStopSec.*/DefaultTimeoutStopSec=60s/' /etc/systemd/user.conf && \
     sed -i 's/#DefaultTimeoutStopSec.*/DefaultTimeoutStopSec=60s/' /etc/systemd/system.conf && \
     systemctl enable cockpit.service && \
+    systemctl enable ensure-var-log-audit-dir.service && \
     systemctl enable rpm-ostreed-automatic.timer && \
     rm /etc/ssh/sshd_config.d/40-disable-passwords.conf && \
     cp -a /etc/firewalld/firewalld-server.conf /etc/firewalld/firewalld.conf && \

etc/systemd/system/ensure-var-log-audit-dir.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Ensure /var/log/audit is present
+Before=auditd.service
+
+[Service]
+Type=oneshot
+ExecStart=mkdir -p -m 0700 /var/log/audit
+
+[Install]
+WantedBy=multi-user.target