Attachment 157073 Details for Bug 244350 – Create advisory TTY audit events

[patch] Create advisory TTY audit events

readline-5.1.patch (text/plain), 1.65 KB, created by Miloslav Trmač on 2007-06-15 08:31:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Miloslav Trmač

Created: 2007-06-15 08:31:03 UTC

Size: 1.65 KB

patch

obsolete

>diff -ur readline/readline.c readline-5.1/readline.c
>--- readline/readline.c	2007-06-06 07:06:51.000000000 +0200
>+++ readline-5.1/readline.c	2007-06-06 07:08:43.000000000 +0200
>@@ -49,6 +49,9 @@
> 
> #include <stdio.h>
> #include "posixjmp.h"
>+#include <sys/socket.h>
>+#include <linux/audit.h>
>+#include <linux/netlink.h>
> 
> /* System-specific feature definitions and include files. */
> #include "rldefs.h"
>@@ -287,7 +290,45 @@
>   rl_visible_prompt_length = rl_expand_prompt (rl_prompt);
>   return 0;
> }
>-  
>+
>+/* Report STRING to the audit system. */
>+static void
>+audit_tty (char *string)
>+{
>+  struct sockaddr_nl addr;
>+  struct msghdr msg;
>+  struct nlmsghdr nlm;
>+  struct iovec iov[2];
>+  size_t size;
>+  int fd;
>+
>+  size = strlen (string) + 1;
>+  fd = socket (AF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
>+  if (fd < 0)
>+    return;
>+  nlm.nlmsg_len = NLMSG_LENGTH (size);
>+  nlm.nlmsg_type = AUDIT_USER_TTY;
>+  nlm.nlmsg_flags = NLM_F_REQUEST;
>+  nlm.nlmsg_seq = 0;
>+  nlm.nlmsg_pid = 0;
>+  iov[0].iov_base = &nlm;
>+  iov[0].iov_len = sizeof (nlm);
>+  iov[1].iov_base = string;
>+  iov[1].iov_len = size;
>+  addr.nl_family = AF_NETLINK;
>+  addr.nl_pid = 0;
>+  addr.nl_groups = 0;
>+  msg.msg_name = &addr;
>+  msg.msg_namelen = sizeof (addr);
>+  msg.msg_iov = iov;
>+  msg.msg_iovlen = 2;
>+  msg.msg_control = NULL;
>+  msg.msg_controllen = 0;
>+  msg.msg_flags = 0;
>+  (void)sendmsg (fd, &msg, 0);
>+  close (fd);
>+}
>+
> /* Read a line of input.  Prompt with PROMPT.  An empty PROMPT means
>    none.  A return value of NULL means that EOF was encountered. */
> char *
>@@ -321,6 +362,9 @@
>   rl_clear_signals ();
> #endif
> 
>+  if (value != NULL)
>+    audit_tty (value);
>+
>   return (value);
> }
>

Actions: View | Diff

Attachments on bug 244350: 157073 | 278931