Attachment 151083 Details for Bug 232993 – Proposed patch

[patch] Proposed patch

pam-0.99.6.2-limits-audit-logins.patch (text/plain), 2.66 KB, created by Tomas Mraz on 2007-03-27 21:08:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Mraz

Created: 2007-03-27 21:08:18 UTC

Size: 2.66 KB

patch

obsolete

>--- Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.c.audit-logins	2006-08-05 20:02:44.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.c	2007-03-27 21:30:06.000000000 +0200
>@@ -101,6 +101,53 @@
> #define PAM_DO_SETREUID     0x0002
> #define PAM_UTMP_EARLY      0x0004
> 
>+#ifdef HAVE_LIBAUDIT
>+#include <libaudit.h>                                                                                                                                            
>+
>+static int
>+_pam_audit_writelog(pam_handle_t *pamh, const char *user, int type, 
>+	const char *message, int success)
>+{
>+    int rc = PAM_SUCCESS;
>+    char buf[256];
>+    int audit_fd;
>+    const void *rhost;
>+    const void *tty;
>+
>+    audit_fd = audit_open();
>+    if (audit_fd < 0) {
>+    	/* You get these error codes only when the kernel doesn't have
>+	 * audit compiled in. */
>+    	if (errno == EINVAL || errno == EPROTONOSUPPORT ||
>+            errno == EAFNOSUPPORT)
>+	    return PAM_SUCCESS;
>+
>+	/* this should only fail in case of extreme resource shortage,
>+	 * need to prevent login in that case.
>+	 */
>+	pam_syslog(pamh, LOG_CRIT, "audit_open() failed: %m");
>+	return PAM_SYSTEM_ERR;
>+    }
>+
>+    snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, user);
>+
>+    if (pam_get_item(pamh, PAM_TTY, &tty) != PAM_SUCCESS) {
>+    	tty = NULL;
>+    }
>+
>+    if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS) {
>+    	rhost = NULL;
>+    }
>+
>+    if (audit_log_user_message(audit_fd, type, buf, rhost, NULL, tty,
>+	success) < 0) {
>+	rc = PAM_SYSTEM_ERR;
>+    }
>+    audit_close(audit_fd);
>+    return rc;
>+}
>+#endif
>+
> static int
> _pam_parse (const pam_handle_t *pamh, int argc, const char **argv,
> 	    struct pam_limit_s *pl)
>@@ -584,6 +631,10 @@
> 	D(("skip login limit check for uid=0"));
>     } else if (pl->login_limit > 0) {
>         if (check_logins(pamh, uname, pl->login_limit, ctrl, pl) == LOGIN_ERR) {
>+#ifdef HAVE_LIBAUDIT
>+            _pam_audit_writelog(pamh, uname, AUDIT_ANOM_LOGIN_SESSIONS,
>+            	"pam_limits", 0); /* ignore return value as we fail anyway */
>+#endif
>             retval |= LOGIN_ERR;
> 	}
>     } else if (pl->login_limit == 0) {
>--- Linux-PAM-0.99.6.2/modules/pam_limits/Makefile.am.audit-logins	2006-06-17 12:29:10.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_limits/Makefile.am	2007-03-27 21:31:38.000000000 +0200
>@@ -17,7 +17,7 @@
> AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \
> 	-DLIMITS_FILE=\"$(SCONFIGDIR)/limits.conf\"
> AM_LDFLAGS = -no-undefined -avoid-version -module \
>-	-L$(top_builddir)/libpam -lpam
>+	-L$(top_builddir)/libpam -lpam $(LIBAUDIT)
> if HAVE_VERSIONING
>   AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map
> endif

Actions: View | Diff

Attachments on bug 232993: 151083 | 151407