Attachment 151407 Details for Bug 232993 – Proposed patch which adds also pam_time and pam_access support

[patch] Proposed patch which adds also pam_time and pam_access support

pam-0.99.6.2-audit-logins.patch (text/plain), 15.95 KB, created by Tomas Mraz on 2007-04-02 08:46:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Mraz

Created: 2007-04-02 08:46:36 UTC

Size: 15.95 KB

patch

obsolete

>--- Linux-PAM-0.99.6.2/modules/pam_access/pam_access.8.xml.audit-logins	2007-03-30 18:55:40.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_access/pam_access.8.xml	2007-03-30 18:55:41.000000000 +0200
>@@ -26,6 +26,9 @@
>         debug
>       </arg>
>       <arg choice="opt">
>+        noaudit
>+      </arg>
>+      <arg choice="opt">
>         accessfile=<replaceable>file</replaceable>
>       </arg>
>       <arg choice="opt">
>@@ -84,6 +87,17 @@
> 
>       <varlistentry>
>         <term>
>+          <option>noaudit</option>
>+        </term>
>+        <listitem>
>+          <para>
>+            Do not report logins from disallowed hosts and ttys to the audit subsystem.
>+          </para>
>+        </listitem>
>+      </varlistentry>
>+
>+      <varlistentry>
>+        <term>
>           <option>fieldsep=<replaceable>separators</replaceable></option>
>         </term>
>         <listitem>
>--- Linux-PAM-0.99.6.2/modules/pam_access/pam_access.c.audit-logins	2007-03-30 18:55:40.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_access/pam_access.c	2007-03-30 18:55:41.000000000 +0200
>@@ -84,8 +84,7 @@
> static const char *fs = ":";			/* field separator */
> static const char *sep = ", \t";		/* list-element separator */
> 
>- /* Constants to be used in assignments only, not in comparisons... */
>-
>+#define ALL             2
> #define YES             1
> #define NO              0
> 
>@@ -97,12 +96,60 @@
>     const struct passwd *user;
>     const char *from;
>     const char *config_file;
>+    int noaudit;
> };
> 
> /* Print debugging messages.
>    Default is NO which means don't print debugging messages.  */
> static char pam_access_debug = NO;
> 
>+#ifdef HAVE_LIBAUDIT
>+#include <libaudit.h>                                                                                                                                            
>+
>+static int
>+_pam_audit_writelog(pam_handle_t *pamh, const char *user, int type, 
>+	const char *message, int success)
>+{
>+    int rc = PAM_SUCCESS;
>+    char buf[256];
>+    int audit_fd;
>+    const void *rhost;
>+    const void *tty;
>+
>+    audit_fd = audit_open();
>+    if (audit_fd < 0) {
>+    	/* You get these error codes only when the kernel doesn't have
>+	 * audit compiled in. */
>+    	if (errno == EINVAL || errno == EPROTONOSUPPORT ||
>+            errno == EAFNOSUPPORT)
>+	    return PAM_SUCCESS;
>+
>+	/* this should only fail in case of extreme resource shortage,
>+	 * need to prevent login in that case.
>+	 */
>+	pam_syslog(pamh, LOG_CRIT, "audit_open() failed: %m");
>+	return PAM_SYSTEM_ERR;
>+    }
>+
>+    snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, user);
>+
>+    if (pam_get_item(pamh, PAM_TTY, &tty) != PAM_SUCCESS) {
>+    	tty = NULL;
>+    }
>+
>+    if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS) {
>+    	rhost = NULL;
>+    }
>+
>+    if (audit_log_user_message(audit_fd, type, buf, rhost, NULL, tty,
>+	success) < 0) {
>+	rc = PAM_SYSTEM_ERR;
>+    }
>+    audit_close(audit_fd);
>+    return rc;
>+}
>+#endif
>+
> /* Parse module config arguments */
> 
> static int
>@@ -110,6 +157,8 @@
>            int argc, const char **argv)
> {
>     int i;
>+    
>+    loginfo->noaudit = NO;
> 
>     for (i=0; i<argc; ++i) {
> 	if (!strncmp("fieldsep=", argv[i], 9)) {
>@@ -136,6 +185,8 @@
> 
> 	} else if (strcmp (argv[i], "debug") == 0) {
> 	    pam_access_debug = YES;
>+	} else if (strcmp (argv[i], "noaudit") == 0) {
>+	    loginfo->noaudit = YES;
> 	} else {
> 	    pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]);
> 	}
>@@ -319,6 +370,7 @@
>     char   *users;		/* becomes list of login names */
>     char   *froms;		/* becomes list of terminals or hosts */
>     int     match = NO;
>+    int     nonall_match = NO;
>     int     end;
>     int     lineno = 0;		/* for diagnostics */
> 
>@@ -369,14 +421,19 @@
> 	    if (pam_access_debug)
> 	      pam_syslog (pamh, LOG_DEBUG,
> 			  "line %d: %s : %s : %s", lineno, perm, users, froms);
>-	    match = list_match(pamh, froms, item, from_match);
>-	    if (pam_access_debug)
>-	      pam_syslog (pamh, LOG_DEBUG,
>-			  "from_match=%d, \"%s\"", match, item->from);
>-	    match = match && list_match (pamh, users, item, user_match);
>+	    match = list_match (pamh, users, item, user_match);
> 	    if (pam_access_debug)
> 	      pam_syslog (pamh, LOG_DEBUG, "user_match=%d, \"%s\"",
> 			  match, item->user->pw_name);
>+	    if (match) {
>+		match = list_match(pamh, froms, item, from_match);
>+		if (!match && perm[0] == '+') {
>+		    nonall_match = YES;
>+		}
>+		if (pam_access_debug)
>+	    	    pam_syslog (pamh, LOG_DEBUG,
>+			  "from_match=%d, \"%s\"", match, item->from);
>+	    }
> 	}
> 	(void) fclose(fp);
>     } else if (errno == ENOENT) {
>@@ -387,6 +444,13 @@
>         pam_syslog(pamh, LOG_ERR, "cannot open %s: %m", item->config_file);
> 	return NO;
>     }
>+#ifdef HAVE_LIBAUDIT
>+    if (!item->noaudit && line[0] == '-' && (match == YES || (match == ALL &&
>+	nonall_match == YES))) {
>+	_pam_audit_writelog(pamh, item->user->pw_name, AUDIT_ANOM_LOGIN_LOCATION,
>+	    "pam_access", 0);
>+    }
>+#endif
>     return (match == NO || (line[0] == '+'));
> }
> 
>@@ -417,8 +481,10 @@
>     if (match != NO) {
> 	while ((tok = strtok((char *) 0, sep)) && strcasecmp(tok, "EXCEPT"))
> 	     /* VOID */ ;
>-	if (tok == 0 || list_match(pamh, (char *) 0, item, match_fn) == NO)
>-	    return (match);
>+	if (tok == 0)
>+	    return match;
>+	if (list_match(pamh, (char *) 0, item, match_fn) == NO)
>+	    return YES; /* drop special meaning of ALL */
>     }
>     return (NO);
> }
>@@ -466,6 +532,7 @@
>     char   *string = item->user->pw_name;
>     struct login_info fake_item;
>     char   *at;
>+    int    rv;
> 
>     if (pam_access_debug)
>       pam_syslog (pamh, LOG_DEBUG,
>@@ -487,8 +554,8 @@
> 		from_match (pamh, at + 1, &fake_item));
>     } else if (tok[0] == '@') /* netgroup */
>       return (netgroup_match (pamh, tok + 1, (char *) 0, string));
>-    else if (string_match (pamh, tok, string)) /* ALL or exact match */
>-	return YES;
>+    else if ((rv = string_match (pamh, tok, string)) != NO) /* ALL or exact match */
>+	return rv;
>     else if (pam_modutil_user_in_group_nam_nam (pamh, item->user->pw_name, tok))
>       /* try group membership */
>       return YES;
>@@ -504,6 +571,7 @@
>     const char *string = item->from;
>     int        tok_len;
>     int        str_len;
>+    int        rv;
> 
>     if (pam_access_debug)
>       pam_syslog (pamh, LOG_DEBUG,
>@@ -522,9 +590,9 @@
> 	return NO;
>     } else if (tok[0] == '@') {			/* netgroup */
>         return (netgroup_match (pamh, tok + 1, string, (char *) 0));
>-    } else if (string_match(pamh, tok, string)) {
>+    } else if ((rv = string_match(pamh, tok, string)) != NO) {
>         /* ALL or exact match */
>-	return (YES);
>+	return rv;
>     } else if (tok[0] == '.') {			/* domain: match last fields */
> 	if ((str_len = strlen(string)) > (tok_len = strlen(tok))
> 	    && strcasecmp(tok, string + str_len - tok_len) == 0)
>@@ -628,7 +696,7 @@
>      */
> 
>     if (strcasecmp(tok, "ALL") == 0) {		/* all: always matches */
>-	return (YES);
>+	return (ALL);
>     } else if (string != NULL) {
> 	if (strcasecmp(tok, string) == 0) {	/* try exact match */
> 	    return (YES);
>--- Linux-PAM-0.99.6.2/modules/pam_time/pam_time.c.audit-logins	2006-06-16 08:35:16.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_time/pam_time.c	2007-03-30 21:19:39.000000000 +0200
>@@ -25,6 +25,9 @@
> #define PAM_TIME_BUFLEN        1000
> #define FIELD_SEPARATOR        ';'   /* this is new as of .02 */
> 
>+#define PAM_DEBUG_ARG       0x0001
>+#define PAM_NO_AUDIT        0x0002
>+
> #ifndef TRUE
> # define TRUE 1
> #endif
>@@ -47,6 +50,76 @@
> #include <security/pam_modules.h>
> #include <security/pam_ext.h>
> 
>+#ifdef HAVE_LIBAUDIT
>+#include <errno.h>
>+#include <libaudit.h>                                                                                                                                            
>+
>+static int
>+_pam_audit_writelog(pam_handle_t *pamh, const char *user, int type, 
>+	const char *message, int success)
>+{
>+    int rc = PAM_SUCCESS;
>+    char buf[256];
>+    int audit_fd;
>+    const void *rhost;
>+    const void *tty;
>+
>+    audit_fd = audit_open();
>+    if (audit_fd < 0) {
>+    	/* You get these error codes only when the kernel doesn't have
>+	 * audit compiled in. */
>+    	if (errno == EINVAL || errno == EPROTONOSUPPORT ||
>+            errno == EAFNOSUPPORT)
>+	    return PAM_SUCCESS;
>+
>+	/* this should only fail in case of extreme resource shortage,
>+	 * need to prevent login in that case.
>+	 */
>+	pam_syslog(pamh, LOG_CRIT, "audit_open() failed: %m");
>+	return PAM_SYSTEM_ERR;
>+    }
>+
>+    snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, user);
>+
>+    if (pam_get_item(pamh, PAM_TTY, &tty) != PAM_SUCCESS) {
>+    	tty = NULL;
>+    }
>+
>+    if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS) {
>+    	rhost = NULL;
>+    }
>+
>+    if (audit_log_user_message(audit_fd, type, buf, rhost, NULL, tty,
>+	success) < 0) {
>+	rc = PAM_SYSTEM_ERR;
>+    }
>+    audit_close(audit_fd);
>+    return rc;
>+}
>+#endif
>+
>+static int
>+_pam_parse (const pam_handle_t *pamh, int argc, const char **argv)
>+{
>+    int ctrl = 0;
>+
>+    /* step through arguments */
>+    for (; argc-- > 0; ++argv) {
>+
>+	/* generic options */
>+
>+	if (!strcmp(*argv, "debug")) {
>+	    ctrl |= PAM_DEBUG_ARG;
>+	} else if (!strcmp(*argv, "noaudit")) {
>+	    ctrl |= PAM_NO_AUDIT;
>+	} else {
>+	    pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv);
>+	}
>+    }
>+
>+    return ctrl;
>+}
>+
> /* --- static functions for checking whether the user should be let in --- */
> 
> static void
>@@ -559,11 +632,15 @@
> 
> PAM_EXTERN int
> pam_sm_acct_mgmt(pam_handle_t *pamh, int flags UNUSED,
>-		 int argc UNUSED, const char **argv UNUSED)
>+		 int argc, const char **argv)
> {
>     const void *service=NULL, *void_tty=NULL;
>     const char *tty;
>     const char *user=NULL;
>+    int ctrl;
>+    int rv;
>+
>+    ctrl = _pam_parse(pamh, argc, argv);
> 
>     /* set service name */
> 
>@@ -612,7 +689,19 @@
>     D(("user=%s", user));
>     D(("tty=%s", tty));
> 
>-    return check_account(pamh, service, tty, user);
>+    rv = check_account(pamh, service, tty, user);
>+    if (rv != PAM_SUCCESS) {
>+#ifdef HAVE_LIBAUDIT
>+	if (!(ctrl & PAM_NO_AUDIT)) {
>+            _pam_audit_writelog(pamh, user, AUDIT_ANOM_LOGIN_TIME,
>+            	    "pam_time", 0); /* ignore return value as we fail anyway */
>+        }
>+#endif
>+	if (ctrl & PAM_DEBUG_ARG) {
>+	    pam_syslog(pamh, LOG_DEBUG, "user %s rejected", user);
>+	}
>+    }
>+    return rv;
> }
> 
> /* end of module definition */
>--- Linux-PAM-0.99.6.2/modules/pam_time/pam_time.8.xml.audit-logins	2006-06-22 21:44:30.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_time/pam_time.8.xml	2007-03-30 18:55:41.000000000 +0200
>@@ -22,6 +22,12 @@
>   <refsynopsisdiv>
>     <cmdsynopsis id="pam_time-cmdsynopsis">
>       <command>pam_time.so</command>
>+      <arg choice="opt">
>+        debug
>+      </arg>
>+      <arg choice="opt">
>+        noaudit
>+      </arg>
>     </cmdsynopsis>
>   </refsynopsisdiv>
> 
>@@ -45,7 +51,32 @@
> 
>   <refsect1 id="pam_time-options">
>     <title>OPTIONS</title>
>-    <para>This module does not recognice any options.</para>
>+    <variablelist>
>+
>+      <varlistentry>
>+        <term>
>+          <option>debug</option>
>+        </term>
>+        <listitem>
>+          <para>
>+            Some debug informations are printed with
>+            <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
>+          </para>
>+        </listitem>
>+      </varlistentry>
>+
>+      <varlistentry>
>+        <term>
>+          <option>noaudit</option>
>+        </term>
>+        <listitem>
>+          <para>
>+            Do not report logins at disallowed time to the audit subsystem.
>+          </para>
>+        </listitem>
>+      </varlistentry>
>+
>+    </variablelist>
>   </refsect1>
> 
>   <refsect1 id="pam_time-services">
>--- Linux-PAM-0.99.6.2/modules/pam_time/Makefile.am.audit-logins	2006-06-09 20:18:43.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_time/Makefile.am	2007-03-30 18:55:41.000000000 +0200
>@@ -17,7 +17,7 @@
> AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \
> 	-DPAM_TIME_CONF=\"$(SCONFIGDIR)/time.conf\"
> AM_LDFLAGS = -no-undefined -avoid-version -module \
>-	-L$(top_builddir)/libpam -lpam
>+	-L$(top_builddir)/libpam -lpam $(LIBAUDIT)
> if HAVE_VERSIONING
>   AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map
> endif
>--- Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.c.audit-logins	2006-08-05 20:02:44.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.c	2007-03-30 18:55:41.000000000 +0200
>@@ -100,6 +100,59 @@
> #define PAM_DEBUG_ARG       0x0001
> #define PAM_DO_SETREUID     0x0002
> #define PAM_UTMP_EARLY      0x0004
>+#define PAM_NO_AUDIT        0x0008
>+
>+#ifdef HAVE_LIBAUDIT
>+#include <libaudit.h>                                                                                                                                            
>+
>+/* Limits from globbed files. */
>+#define LIMITS_CONF_GLOB LIMITS_FILE_DIR
>+
>+#define CONF_FILE (pl->conf_file != NULL)?pl->conf_file:LIMITS_FILE
>+
>+static int
>+_pam_audit_writelog(pam_handle_t *pamh, const char *user, int type, 
>+	const char *message, int success)
>+{
>+    int rc = PAM_SUCCESS;
>+    char buf[256];
>+    int audit_fd;
>+    const void *rhost;
>+    const void *tty;
>+
>+    audit_fd = audit_open();
>+    if (audit_fd < 0) {
>+    	/* You get these error codes only when the kernel doesn't have
>+	 * audit compiled in. */
>+    	if (errno == EINVAL || errno == EPROTONOSUPPORT ||
>+            errno == EAFNOSUPPORT)
>+	    return PAM_SUCCESS;
>+
>+	/* this should only fail in case of extreme resource shortage,
>+	 * need to prevent login in that case.
>+	 */
>+	pam_syslog(pamh, LOG_CRIT, "audit_open() failed: %m");
>+	return PAM_SYSTEM_ERR;
>+    }
>+
>+    snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, user);
>+
>+    if (pam_get_item(pamh, PAM_TTY, &tty) != PAM_SUCCESS) {
>+    	tty = NULL;
>+    }
>+
>+    if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS) {
>+    	rhost = NULL;
>+    }
>+
>+    if (audit_log_user_message(audit_fd, type, buf, rhost, NULL, tty,
>+	success) < 0) {
>+	rc = PAM_SYSTEM_ERR;
>+    }
>+    audit_close(audit_fd);
>+    return rc;
>+}
>+#endif
> 
> static int
> _pam_parse (const pam_handle_t *pamh, int argc, const char **argv,
>@@ -120,6 +173,8 @@
> 	    ctrl |= PAM_DO_SETREUID;
> 	} else if (!strcmp(*argv,"utmp_early")) {
> 	    ctrl |= PAM_UTMP_EARLY;
>+	} else if (!strcmp(*argv,"noaudit")) {
>+	    ctrl |= PAM_NO_AUDIT;
> 	} else {
> 	    pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv);
> 	}
>@@ -584,6 +639,12 @@
> 	D(("skip login limit check for uid=0"));
>     } else if (pl->login_limit > 0) {
>         if (check_logins(pamh, uname, pl->login_limit, ctrl, pl) == LOGIN_ERR) {
>+#ifdef HAVE_LIBAUDIT
>+	    if (!(ctrl & PAM_NO_AUDIT)) {
>+        	_pam_audit_writelog(pamh, uname, AUDIT_ANOM_LOGIN_SESSIONS,
>+            	    "pam_limits", 0); /* ignore return value as we fail anyway */
>+            }
>+#endif
>             retval |= LOGIN_ERR;
> 	}
>     } else if (pl->login_limit == 0) {
>--- Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.8.xml.audit-logins	2006-06-17 12:29:10.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.8.xml	2007-03-30 18:55:41.000000000 +0200
>@@ -34,6 +34,9 @@
>       <arg choice="opt">
>         utmp_early
>       </arg>
>+      <arg choice="opt">
>+        noaudit
>+      </arg>
>     </cmdsynopsis>
>   </refsynopsisdiv>
> 
>@@ -103,6 +106,16 @@
>           </para>
>         </listitem>
>       </varlistentry>
>+      <varlistentry>
>+        <term>
>+          <option>noaudit</option>
>+        </term>
>+        <listitem>
>+          <para>
>+            Do not report exceeded maximum logins count to the audit subsystem.
>+          </para>
>+        </listitem>
>+      </varlistentry>
>     </variablelist>
>   </refsect1>
> 
>--- Linux-PAM-0.99.6.2/modules/pam_limits/Makefile.am.audit-logins	2006-06-17 12:29:10.000000000 +0200
>+++ Linux-PAM-0.99.6.2/modules/pam_limits/Makefile.am	2007-03-30 18:55:41.000000000 +0200
>@@ -17,7 +17,7 @@
> AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \
> 	-DLIMITS_FILE=\"$(SCONFIGDIR)/limits.conf\"
> AM_LDFLAGS = -no-undefined -avoid-version -module \
>-	-L$(top_builddir)/libpam -lpam
>+	-L$(top_builddir)/libpam -lpam $(LIBAUDIT)
> if HAVE_VERSIONING
>   AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map
> endif

Actions: View | Diff

Attachments on bug 232993: 151083 | 151407