Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 151407 Details for
Bug 232993
FIPS 200: audit rejection based on number of sessions, origin and time
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
Proposed patch which adds also pam_time and pam_access support
pam-0.99.6.2-audit-logins.patch (text/plain), 15.95 KB, created by
Tomas Mraz
on 2007-04-02 08:46:36 UTC
(
hide
)
Description:
Proposed patch which adds also pam_time and pam_access support
Filename:
MIME Type:
Creator:
Tomas Mraz
Created:
2007-04-02 08:46:36 UTC
Size:
15.95 KB
patch
obsolete
>--- Linux-PAM-0.99.6.2/modules/pam_access/pam_access.8.xml.audit-logins 2007-03-30 18:55:40.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_access/pam_access.8.xml 2007-03-30 18:55:41.000000000 +0200 >@@ -26,6 +26,9 @@ > debug > </arg> > <arg choice="opt"> >+ noaudit >+ </arg> >+ <arg choice="opt"> > accessfile=<replaceable>file</replaceable> > </arg> > <arg choice="opt"> >@@ -84,6 +87,17 @@ > > <varlistentry> > <term> >+ <option>noaudit</option> >+ </term> >+ <listitem> >+ <para> >+ Do not report logins from disallowed hosts and ttys to the audit subsystem. >+ </para> >+ </listitem> >+ </varlistentry> >+ >+ <varlistentry> >+ <term> > <option>fieldsep=<replaceable>separators</replaceable></option> > </term> > <listitem> >--- Linux-PAM-0.99.6.2/modules/pam_access/pam_access.c.audit-logins 2007-03-30 18:55:40.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_access/pam_access.c 2007-03-30 18:55:41.000000000 +0200 >@@ -84,8 +84,7 @@ > static const char *fs = ":"; /* field separator */ > static const char *sep = ", \t"; /* list-element separator */ > >- /* Constants to be used in assignments only, not in comparisons... */ >- >+#define ALL 2 > #define YES 1 > #define NO 0 > >@@ -97,12 +96,60 @@ > const struct passwd *user; > const char *from; > const char *config_file; >+ int noaudit; > }; > > /* Print debugging messages. > Default is NO which means don't print debugging messages. */ > static char pam_access_debug = NO; > >+#ifdef HAVE_LIBAUDIT >+#include <libaudit.h> >+ >+static int >+_pam_audit_writelog(pam_handle_t *pamh, const char *user, int type, >+ const char *message, int success) >+{ >+ int rc = PAM_SUCCESS; >+ char buf[256]; >+ int audit_fd; >+ const void *rhost; >+ const void *tty; >+ >+ audit_fd = audit_open(); >+ if (audit_fd < 0) { >+ /* You get these error codes only when the kernel doesn't have >+ * audit compiled in. */ >+ if (errno == EINVAL || errno == EPROTONOSUPPORT || >+ errno == EAFNOSUPPORT) >+ return PAM_SUCCESS; >+ >+ /* this should only fail in case of extreme resource shortage, >+ * need to prevent login in that case. >+ */ >+ pam_syslog(pamh, LOG_CRIT, "audit_open() failed: %m"); >+ return PAM_SYSTEM_ERR; >+ } >+ >+ snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, user); >+ >+ if (pam_get_item(pamh, PAM_TTY, &tty) != PAM_SUCCESS) { >+ tty = NULL; >+ } >+ >+ if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS) { >+ rhost = NULL; >+ } >+ >+ if (audit_log_user_message(audit_fd, type, buf, rhost, NULL, tty, >+ success) < 0) { >+ rc = PAM_SYSTEM_ERR; >+ } >+ audit_close(audit_fd); >+ return rc; >+} >+#endif >+ > /* Parse module config arguments */ > > static int >@@ -110,6 +157,8 @@ > int argc, const char **argv) > { > int i; >+ >+ loginfo->noaudit = NO; > > for (i=0; i<argc; ++i) { > if (!strncmp("fieldsep=", argv[i], 9)) { >@@ -136,6 +185,8 @@ > > } else if (strcmp (argv[i], "debug") == 0) { > pam_access_debug = YES; >+ } else if (strcmp (argv[i], "noaudit") == 0) { >+ loginfo->noaudit = YES; > } else { > pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]); > } >@@ -319,6 +370,7 @@ > char *users; /* becomes list of login names */ > char *froms; /* becomes list of terminals or hosts */ > int match = NO; >+ int nonall_match = NO; > int end; > int lineno = 0; /* for diagnostics */ > >@@ -369,14 +421,19 @@ > if (pam_access_debug) > pam_syslog (pamh, LOG_DEBUG, > "line %d: %s : %s : %s", lineno, perm, users, froms); >- match = list_match(pamh, froms, item, from_match); >- if (pam_access_debug) >- pam_syslog (pamh, LOG_DEBUG, >- "from_match=%d, \"%s\"", match, item->from); >- match = match && list_match (pamh, users, item, user_match); >+ match = list_match (pamh, users, item, user_match); > if (pam_access_debug) > pam_syslog (pamh, LOG_DEBUG, "user_match=%d, \"%s\"", > match, item->user->pw_name); >+ if (match) { >+ match = list_match(pamh, froms, item, from_match); >+ if (!match && perm[0] == '+') { >+ nonall_match = YES; >+ } >+ if (pam_access_debug) >+ pam_syslog (pamh, LOG_DEBUG, >+ "from_match=%d, \"%s\"", match, item->from); >+ } > } > (void) fclose(fp); > } else if (errno == ENOENT) { >@@ -387,6 +444,13 @@ > pam_syslog(pamh, LOG_ERR, "cannot open %s: %m", item->config_file); > return NO; > } >+#ifdef HAVE_LIBAUDIT >+ if (!item->noaudit && line[0] == '-' && (match == YES || (match == ALL && >+ nonall_match == YES))) { >+ _pam_audit_writelog(pamh, item->user->pw_name, AUDIT_ANOM_LOGIN_LOCATION, >+ "pam_access", 0); >+ } >+#endif > return (match == NO || (line[0] == '+')); > } > >@@ -417,8 +481,10 @@ > if (match != NO) { > while ((tok = strtok((char *) 0, sep)) && strcasecmp(tok, "EXCEPT")) > /* VOID */ ; >- if (tok == 0 || list_match(pamh, (char *) 0, item, match_fn) == NO) >- return (match); >+ if (tok == 0) >+ return match; >+ if (list_match(pamh, (char *) 0, item, match_fn) == NO) >+ return YES; /* drop special meaning of ALL */ > } > return (NO); > } >@@ -466,6 +532,7 @@ > char *string = item->user->pw_name; > struct login_info fake_item; > char *at; >+ int rv; > > if (pam_access_debug) > pam_syslog (pamh, LOG_DEBUG, >@@ -487,8 +554,8 @@ > from_match (pamh, at + 1, &fake_item)); > } else if (tok[0] == '@') /* netgroup */ > return (netgroup_match (pamh, tok + 1, (char *) 0, string)); >- else if (string_match (pamh, tok, string)) /* ALL or exact match */ >- return YES; >+ else if ((rv = string_match (pamh, tok, string)) != NO) /* ALL or exact match */ >+ return rv; > else if (pam_modutil_user_in_group_nam_nam (pamh, item->user->pw_name, tok)) > /* try group membership */ > return YES; >@@ -504,6 +571,7 @@ > const char *string = item->from; > int tok_len; > int str_len; >+ int rv; > > if (pam_access_debug) > pam_syslog (pamh, LOG_DEBUG, >@@ -522,9 +590,9 @@ > return NO; > } else if (tok[0] == '@') { /* netgroup */ > return (netgroup_match (pamh, tok + 1, string, (char *) 0)); >- } else if (string_match(pamh, tok, string)) { >+ } else if ((rv = string_match(pamh, tok, string)) != NO) { > /* ALL or exact match */ >- return (YES); >+ return rv; > } else if (tok[0] == '.') { /* domain: match last fields */ > if ((str_len = strlen(string)) > (tok_len = strlen(tok)) > && strcasecmp(tok, string + str_len - tok_len) == 0) >@@ -628,7 +696,7 @@ > */ > > if (strcasecmp(tok, "ALL") == 0) { /* all: always matches */ >- return (YES); >+ return (ALL); > } else if (string != NULL) { > if (strcasecmp(tok, string) == 0) { /* try exact match */ > return (YES); >--- Linux-PAM-0.99.6.2/modules/pam_time/pam_time.c.audit-logins 2006-06-16 08:35:16.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_time/pam_time.c 2007-03-30 21:19:39.000000000 +0200 >@@ -25,6 +25,9 @@ > #define PAM_TIME_BUFLEN 1000 > #define FIELD_SEPARATOR ';' /* this is new as of .02 */ > >+#define PAM_DEBUG_ARG 0x0001 >+#define PAM_NO_AUDIT 0x0002 >+ > #ifndef TRUE > # define TRUE 1 > #endif >@@ -47,6 +50,76 @@ > #include <security/pam_modules.h> > #include <security/pam_ext.h> > >+#ifdef HAVE_LIBAUDIT >+#include <errno.h> >+#include <libaudit.h> >+ >+static int >+_pam_audit_writelog(pam_handle_t *pamh, const char *user, int type, >+ const char *message, int success) >+{ >+ int rc = PAM_SUCCESS; >+ char buf[256]; >+ int audit_fd; >+ const void *rhost; >+ const void *tty; >+ >+ audit_fd = audit_open(); >+ if (audit_fd < 0) { >+ /* You get these error codes only when the kernel doesn't have >+ * audit compiled in. */ >+ if (errno == EINVAL || errno == EPROTONOSUPPORT || >+ errno == EAFNOSUPPORT) >+ return PAM_SUCCESS; >+ >+ /* this should only fail in case of extreme resource shortage, >+ * need to prevent login in that case. >+ */ >+ pam_syslog(pamh, LOG_CRIT, "audit_open() failed: %m"); >+ return PAM_SYSTEM_ERR; >+ } >+ >+ snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, user); >+ >+ if (pam_get_item(pamh, PAM_TTY, &tty) != PAM_SUCCESS) { >+ tty = NULL; >+ } >+ >+ if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS) { >+ rhost = NULL; >+ } >+ >+ if (audit_log_user_message(audit_fd, type, buf, rhost, NULL, tty, >+ success) < 0) { >+ rc = PAM_SYSTEM_ERR; >+ } >+ audit_close(audit_fd); >+ return rc; >+} >+#endif >+ >+static int >+_pam_parse (const pam_handle_t *pamh, int argc, const char **argv) >+{ >+ int ctrl = 0; >+ >+ /* step through arguments */ >+ for (; argc-- > 0; ++argv) { >+ >+ /* generic options */ >+ >+ if (!strcmp(*argv, "debug")) { >+ ctrl |= PAM_DEBUG_ARG; >+ } else if (!strcmp(*argv, "noaudit")) { >+ ctrl |= PAM_NO_AUDIT; >+ } else { >+ pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv); >+ } >+ } >+ >+ return ctrl; >+} >+ > /* --- static functions for checking whether the user should be let in --- */ > > static void >@@ -559,11 +632,15 @@ > > PAM_EXTERN int > pam_sm_acct_mgmt(pam_handle_t *pamh, int flags UNUSED, >- int argc UNUSED, const char **argv UNUSED) >+ int argc, const char **argv) > { > const void *service=NULL, *void_tty=NULL; > const char *tty; > const char *user=NULL; >+ int ctrl; >+ int rv; >+ >+ ctrl = _pam_parse(pamh, argc, argv); > > /* set service name */ > >@@ -612,7 +689,19 @@ > D(("user=%s", user)); > D(("tty=%s", tty)); > >- return check_account(pamh, service, tty, user); >+ rv = check_account(pamh, service, tty, user); >+ if (rv != PAM_SUCCESS) { >+#ifdef HAVE_LIBAUDIT >+ if (!(ctrl & PAM_NO_AUDIT)) { >+ _pam_audit_writelog(pamh, user, AUDIT_ANOM_LOGIN_TIME, >+ "pam_time", 0); /* ignore return value as we fail anyway */ >+ } >+#endif >+ if (ctrl & PAM_DEBUG_ARG) { >+ pam_syslog(pamh, LOG_DEBUG, "user %s rejected", user); >+ } >+ } >+ return rv; > } > > /* end of module definition */ >--- Linux-PAM-0.99.6.2/modules/pam_time/pam_time.8.xml.audit-logins 2006-06-22 21:44:30.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_time/pam_time.8.xml 2007-03-30 18:55:41.000000000 +0200 >@@ -22,6 +22,12 @@ > <refsynopsisdiv> > <cmdsynopsis id="pam_time-cmdsynopsis"> > <command>pam_time.so</command> >+ <arg choice="opt"> >+ debug >+ </arg> >+ <arg choice="opt"> >+ noaudit >+ </arg> > </cmdsynopsis> > </refsynopsisdiv> > >@@ -45,7 +51,32 @@ > > <refsect1 id="pam_time-options"> > <title>OPTIONS</title> >- <para>This module does not recognice any options.</para> >+ <variablelist> >+ >+ <varlistentry> >+ <term> >+ <option>debug</option> >+ </term> >+ <listitem> >+ <para> >+ Some debug informations are printed with >+ <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>. >+ </para> >+ </listitem> >+ </varlistentry> >+ >+ <varlistentry> >+ <term> >+ <option>noaudit</option> >+ </term> >+ <listitem> >+ <para> >+ Do not report logins at disallowed time to the audit subsystem. >+ </para> >+ </listitem> >+ </varlistentry> >+ >+ </variablelist> > </refsect1> > > <refsect1 id="pam_time-services"> >--- Linux-PAM-0.99.6.2/modules/pam_time/Makefile.am.audit-logins 2006-06-09 20:18:43.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_time/Makefile.am 2007-03-30 18:55:41.000000000 +0200 >@@ -17,7 +17,7 @@ > AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ > -DPAM_TIME_CONF=\"$(SCONFIGDIR)/time.conf\" > AM_LDFLAGS = -no-undefined -avoid-version -module \ >- -L$(top_builddir)/libpam -lpam >+ -L$(top_builddir)/libpam -lpam $(LIBAUDIT) > if HAVE_VERSIONING > AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map > endif >--- Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.c.audit-logins 2006-08-05 20:02:44.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.c 2007-03-30 18:55:41.000000000 +0200 >@@ -100,6 +100,59 @@ > #define PAM_DEBUG_ARG 0x0001 > #define PAM_DO_SETREUID 0x0002 > #define PAM_UTMP_EARLY 0x0004 >+#define PAM_NO_AUDIT 0x0008 >+ >+#ifdef HAVE_LIBAUDIT >+#include <libaudit.h> >+ >+/* Limits from globbed files. */ >+#define LIMITS_CONF_GLOB LIMITS_FILE_DIR >+ >+#define CONF_FILE (pl->conf_file != NULL)?pl->conf_file:LIMITS_FILE >+ >+static int >+_pam_audit_writelog(pam_handle_t *pamh, const char *user, int type, >+ const char *message, int success) >+{ >+ int rc = PAM_SUCCESS; >+ char buf[256]; >+ int audit_fd; >+ const void *rhost; >+ const void *tty; >+ >+ audit_fd = audit_open(); >+ if (audit_fd < 0) { >+ /* You get these error codes only when the kernel doesn't have >+ * audit compiled in. */ >+ if (errno == EINVAL || errno == EPROTONOSUPPORT || >+ errno == EAFNOSUPPORT) >+ return PAM_SUCCESS; >+ >+ /* this should only fail in case of extreme resource shortage, >+ * need to prevent login in that case. >+ */ >+ pam_syslog(pamh, LOG_CRIT, "audit_open() failed: %m"); >+ return PAM_SYSTEM_ERR; >+ } >+ >+ snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, user); >+ >+ if (pam_get_item(pamh, PAM_TTY, &tty) != PAM_SUCCESS) { >+ tty = NULL; >+ } >+ >+ if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS) { >+ rhost = NULL; >+ } >+ >+ if (audit_log_user_message(audit_fd, type, buf, rhost, NULL, tty, >+ success) < 0) { >+ rc = PAM_SYSTEM_ERR; >+ } >+ audit_close(audit_fd); >+ return rc; >+} >+#endif > > static int > _pam_parse (const pam_handle_t *pamh, int argc, const char **argv, >@@ -120,6 +173,8 @@ > ctrl |= PAM_DO_SETREUID; > } else if (!strcmp(*argv,"utmp_early")) { > ctrl |= PAM_UTMP_EARLY; >+ } else if (!strcmp(*argv,"noaudit")) { >+ ctrl |= PAM_NO_AUDIT; > } else { > pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv); > } >@@ -584,6 +639,12 @@ > D(("skip login limit check for uid=0")); > } else if (pl->login_limit > 0) { > if (check_logins(pamh, uname, pl->login_limit, ctrl, pl) == LOGIN_ERR) { >+#ifdef HAVE_LIBAUDIT >+ if (!(ctrl & PAM_NO_AUDIT)) { >+ _pam_audit_writelog(pamh, uname, AUDIT_ANOM_LOGIN_SESSIONS, >+ "pam_limits", 0); /* ignore return value as we fail anyway */ >+ } >+#endif > retval |= LOGIN_ERR; > } > } else if (pl->login_limit == 0) { >--- Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.8.xml.audit-logins 2006-06-17 12:29:10.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_limits/pam_limits.8.xml 2007-03-30 18:55:41.000000000 +0200 >@@ -34,6 +34,9 @@ > <arg choice="opt"> > utmp_early > </arg> >+ <arg choice="opt"> >+ noaudit >+ </arg> > </cmdsynopsis> > </refsynopsisdiv> > >@@ -103,6 +106,16 @@ > </para> > </listitem> > </varlistentry> >+ <varlistentry> >+ <term> >+ <option>noaudit</option> >+ </term> >+ <listitem> >+ <para> >+ Do not report exceeded maximum logins count to the audit subsystem. >+ </para> >+ </listitem> >+ </varlistentry> > </variablelist> > </refsect1> > >--- Linux-PAM-0.99.6.2/modules/pam_limits/Makefile.am.audit-logins 2006-06-17 12:29:10.000000000 +0200 >+++ Linux-PAM-0.99.6.2/modules/pam_limits/Makefile.am 2007-03-30 18:55:41.000000000 +0200 >@@ -17,7 +17,7 @@ > AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ > -DLIMITS_FILE=\"$(SCONFIGDIR)/limits.conf\" > AM_LDFLAGS = -no-undefined -avoid-version -module \ >- -L$(top_builddir)/libpam -lpam >+ -L$(top_builddir)/libpam -lpam $(LIBAUDIT) > if HAVE_VERSIONING > AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map > endif
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 232993
:
151083
| 151407