]> granicus.if.org Git - linux-pam/commit
Add grantor field to audit records of libpam.
authorTomas Mraz <tmraz@fedoraproject.org>
Fri, 5 Sep 2014 07:09:37 +0000 (09:09 +0200)
committerTomas Mraz <tmraz@fedoraproject.org>
Fri, 5 Sep 2014 07:09:37 +0000 (09:09 +0200)
commit0d29e379601819c7f7ed8de18b54de803a9f4049
treee9073940dbece1dc7c3b6cf9f5cc9f9b39eaba4a
parent8cfc3e7a9aa7f40aeafe58aa88bc1bfca5282afe
Add grantor field to audit records of libpam.

The grantor field gives audit trail of PAM modules which granted access
for successful return from libpam calls. In case of failed return
the grantor field is set to '?'.
libpam/pam_account.c (pam_acct_mgmt): Remove _pam_auditlog() call.
libpam/pam_auth.c (pam_authenticate, pam_setcred): Likewise.
libpam/pam_password.c (pam_chauthtok): Likewise.
libpam/pam_session.c (pam_open_session, pam_close_session): Likewise.
libpam/pam_audit.c (_pam_audit_writelog): Add grantors parameter,
add grantor= field to the message if grantors is set.
(_pam_list_grantors): New function creating the string with grantors list.
(_pam_auditlog): Add struct handler pointer parameter, call _pam_list_grantors()
to list the grantors from the handler list.
(_pam_audit_end): Add NULL handler parameter to _pam_auditlog() call.
(pam_modutil_audit_write): Add NULL grantors parameter to _pam_audit_writelog().
libpam/pam_dispatch.c (_pam_dispatch_aux): Set h->grantor where appropriate.
(_pam_clear_grantors): New function to clear grantor field of handler.
(_pam_dispatch): Call _pam_clear_grantors() before executing the stack.
Call _pam_auditlog() when appropriate.
libpam/pam_handlers.c (extract_modulename): Do not allow empty module name
or just "?" to avoid confusing audit trail.
(_pam_add_handler): Test for NULL return from extract_modulename().
Clear grantor field of handler.
libpam/pam_private.h: Add grantor field to struct handler, add handler pointer
parameter to _pam_auditlog().
libpam/pam_account.c
libpam/pam_audit.c
libpam/pam_auth.c
libpam/pam_dispatch.c
libpam/pam_handlers.c
libpam/pam_password.c
libpam/pam_private.h
libpam/pam_session.c