Description of problem: Lightdm is missing the user_login audit event. Without the event, user login sessions can't be properly located in the audit trail. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. login 2. as root, ausearch --start today -m user_login -x lightdm 3. Actual results: No results Expected results: an event Additional info: Will attach a patch that was sent upstream.
Created attachment 1108521 [details] user_login audit patch This patch adds the missing event. It should be safe to add from a selinux policy view since its already allowing audit events via pam.
This bug appears to have been reported against 'rawhide' during the Fedora 24 development cycle. Changing version to '24'. More information and reason for this action is here: https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora24#Rawhide_Rebase
Rats, seems your patch doesn't apply cleanly to lightdm-1.10.6 , lemme check how bad it is.
Ah, looks like at least some libaudit support was added in 1.10.6 release, do you know offhand if that is sufficient to satisfy you (and this bug)?
OK, I found the thread, https://lists.freedesktop.org/archives/lightdm/2015-December/000911.html I'm going to guess (hope) the answer is yes, please re-open if that is not the case.
This bug was against the older releases. Fedora 22/23's auditing is broken for Cinnamon because we cannot tell a user session from a cron job because of the missing event. As for the upstream audit event, I have not looked at it yet because it was not applicable to Fedora. When I see this event, then I'll know if upstream got it right.
OK, I'll submit f22/f23 1.10.6 updates for testing
lightdm-1.10.6-2.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-97272d76c4
Thanks. When I see it in testing, I'll pull it and give it karma. If something is wrong with the event, I'll contact upstream.
lightdm-1.10.6-2.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-3c5c785f39
lightdm-1.10.6-2.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-3c5c785f39
lightdm-1.10.6-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-97272d76c4
lightdm-1.10.6-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
lightdm-1.10.6-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.