<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/3.32.2"> </HEAD> <BODY> On Tue, 2011-08-09 at 02:46 +0200, Matěj Cepl wrote: <BLOCKQUOTE TYPE=CITE> <PRE> <A HREF="https://bugzilla.redhat.com/469357">https://bugzilla.redhat.com/469357</A> Patch by Steve Grubb <sgrubb at redhat dot com> Signed-off-by: Matěj Cepl <<A HREF="mailto:mcepl@redhat.com">mcepl@redhat.com</A>> --- configure.ac | 22 ++++++++++++++++++++++ greeter/greet.c | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 0 deletions(-) Index: xdm.git/configure.ac =================================================================== --- xdm.git.orig/configure.ac +++ xdm.git/configure.ac @@ -145,6 +145,28 @@ if test "x$USE_SELINUX" != "xno" ; then ) fi +AC_ARG_WITH(libaudit, AS_HELP_STRING([--with-libaudit=<auto/yes/no>], </PRE> </BLOCKQUOTE> I have never seen this auto/yes/no string anywhere in xorg before. Users are not invited to type "yes no" (althought they can), they type --with-libaudit or --without-libaudit or nothing for autodetection. To make everyone life's easy, just copy a similar option like PAM/SELinux above which seems to follow the same pattern and have been cleaned-up and reviewed a little while ago: <BLOCKQUOTE> <PRE> # Check for Linux Audit support AC_ARG_WITH(libaudit, AS_HELP_STRING([--with-libaudit], [Add support for Linux Audit (default is autodetected)]), [USE_LINUX_AUDIT=$withval], [USE_LINUX_AUDIT=auto]) if test "x$USE_LINUX_AUDIT" != "xno" ; then [...] Sorry I can't complete and test the code, but you get the idea. fi [...] </PRE> </BLOCKQUOTE> One question, is it wise to enable Linux Audit by default if the library is installed? Will its use have any distracting effects for those who don't know anything about it and don't even know they have it installed? Like myself :-) <BLOCKQUOTE TYPE=CITE> <PRE> + [Add Linux audit support (default=auto)]), + [], [with_libaudit=auto]) + +# Check for Linux auditing API +# +# libaudit detection +if test x$with_libaudit = xno ; then + have_libaudit=no; +else + # See if we have audit daemon library + AC_CHECK_LIB(audit, audit_log_user_message, + have_libaudit=yes, have_libaudit=no) +fi + +AM_CONDITIONAL(HAVE_LIBAUDIT, test x$have_libaudit = xyes) + +if test x$have_libaudit = xyes ; then + XDMGREET_LIBS="$XDMGREET_LIBS -laudit" + AC_DEFINE(HAVE_LIBAUDIT,1,[linux audit support]) +fi + # FIXME: Find better test for which OS'es use su -m - for now, just try to # mirror the Imakefile setting of: # if defined(OpenBSDArchitecture) || defined(NetBSDArchitecture) || defined(FreeBSDArchitecture) || defined(DarwinArchitecture) @@ -171,7 +193,7 @@ AC_SUBST(SU) # Define a configure option to locate a special file (/dev/random or /dev/urandom) # that serves as a random or a pseudorandom number generator -AC_ARG_WITH(random-device, AS_HELP_STRING([--with-random-device\[=<pathname>\]], +AC_ARG_WITH(random-device, AS_HELP_STRING([--with-random-device=<pathname>], [Use <pathname> as a source of randomness (default is auto-detected)]), [USE_DEVICE="$withval"], [USE_DEVICE="auto"]) if test x$USE_DEVICE != xno ; then Index: xdm.git/greeter/greet.c =================================================================== --- xdm.git.orig/greeter/greet.c +++ xdm.git/greeter/greet.c @@ -86,6 +86,13 @@ from The Open Group. # endif #endif +#ifdef HAVE_LIBAUDIT +#include <libaudit.h> +#include <pwd.h> +#else +#define log_to_audit_system(l,h,s) do { ; } while (0) +#endif + #include <string.h> #if defined(SECURE_RPC) && defined(sun) @@ -415,6 +422,29 @@ FailedLogin (struct display *d, const ch DrawFail (login); } +#ifdef USE_PAM +#ifdef HAVE_LIBAUDIT +static void +log_to_audit_system(const pam_handle_t *pamhp, int success) +{ + struct passwd *pw = NULL; + char *hostname = NULL, *tty = NULL, *login=NULL; + int audit_fd; + + audit_fd = audit_open(); + pam_get_item(pamhp, PAM_RHOST, &hostname); + pam_get_item(pamhp, PAM_TTY, &tty); + pam_get_item(pamhp, PAM_USER, &login); + if (login) + pw = getpwnam(login); + audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN, + NULL, "login", login ? login : "(unknown)", + pw ? pw->pw_uid : -1, hostname, NULL, tty, success); + close(audit_fd); +} +#endif +#endif + _X_EXPORT greet_user_rtn GreetUser( struct display *d, @@ -600,6 +630,7 @@ greet_user_rtn GreetUser( if ((pam_error == PAM_SUCCESS) && (Verify (d, greet, verify))) { SetPrompt (login, 1, "Login Successful", LOGIN_TEXT_INFO, False); SetValue (login, 1, NULL); + log_to_audit_system(*pamhp, 1); break; } else { /* Try to fill in username for failed login error log */ @@ -611,6 +642,7 @@ greet_user_rtn GreetUser( (void *) &username)); } FailedLogin (d, username); + log_to_audit_system(*pamhp, 0); RUN_AND_CHECK_PAM_ERROR(pam_end, (*pamhp, pam_error)); } _______________________________________________ <A HREF="mailto:xorg-devel@lists.x.org">xorg-devel@lists.x.org</A>: X.Org development Archives: <A HREF="http://lists.x.org/archives/xorg-devel">http://lists.x.org/archives/xorg-devel</A> Info: <A HREF="http://lists.x.org/mailman/listinfo/xorg-devel">http://lists.x.org/mailman/listinfo/xorg-devel</A> </PRE> </BLOCKQUOTE> </BODY> </HTML>