110 lines
3.3 KiB
Diff
110 lines
3.3 KiB
Diff
diff -up xdm-1.1.11/config.h.in.add-audit-events xdm-1.1.11/config.h.in
|
|
--- xdm-1.1.11/config.h.in.add-audit-events 2011-09-25 09:42:16.000000000 +0200
|
|
+++ xdm-1.1.11/config.h.in 2011-09-26 17:44:21.796495208 +0200
|
|
@@ -193,6 +193,9 @@
|
|
/* Use PAM for authentication */
|
|
#undef USE_PAM
|
|
|
|
+/* Add linux audit support */
|
|
+#undef HAVE_LIBAUDIT
|
|
+
|
|
/* Use Security-Enhanced Linux (SELinux) support */
|
|
#undef USE_SELINUX
|
|
|
|
diff -up xdm-1.1.11/configure.ac.add-audit-events xdm-1.1.11/configure.ac
|
|
--- xdm-1.1.11/configure.ac.add-audit-events 2011-09-25 09:41:19.000000000 +0200
|
|
+++ xdm-1.1.11/configure.ac 2011-09-26 17:43:30.616557363 +0200
|
|
@@ -145,6 +145,29 @@ if test "x$USE_SELINUX" != "xno" ; then
|
|
)
|
|
fi
|
|
|
|
+AC_ARG_WITH(libaudit,
|
|
+ [ --with-libaudit=[auto/yes/no] Add Linux audit support [default=auto]],,
|
|
+ with_libaudit=auto)
|
|
+
|
|
+# Check for Linux auditing API
|
|
+#
|
|
+# libaudit detection
|
|
+if test x$with_libaudit = xno ; then
|
|
+ have_libaudit=no;
|
|
+else
|
|
+ # See if we have audit daemon library
|
|
+ AC_CHECK_LIB(audit, audit_log_user_message,
|
|
+ have_libaudit=yes, have_libaudit=no)
|
|
+fi
|
|
+
|
|
+AM_CONDITIONAL(HAVE_LIBAUDIT, test x$have_libaudit = xyes)
|
|
+
|
|
+if test x$have_libaudit = xyes ; then
|
|
+ XDMGREET_LIBS="$XDMGREET_LIBS -laudit"
|
|
+ AC_DEFINE(HAVE_LIBAUDIT,1,[linux audit support])
|
|
+fi
|
|
+
|
|
+
|
|
# Check whether to install systemd unit files, as suggested in daemon(7).
|
|
AC_ARG_WITH([systemdsystemunitdir], AS_HELP_STRING([--with-systemdsystemunitdir=DIR],
|
|
[Directory for systemd service files (default from the System and Service Manager)]),,
|
|
diff -up xdm-1.1.11/greeter/greet.c.add-audit-events xdm-1.1.11/greeter/greet.c
|
|
--- xdm-1.1.11/greeter/greet.c.add-audit-events 2011-09-25 09:35:47.000000000 +0200
|
|
+++ xdm-1.1.11/greeter/greet.c 2011-09-26 17:46:11.996361376 +0200
|
|
@@ -86,6 +86,13 @@ from The Open Group.
|
|
# endif
|
|
#endif
|
|
|
|
+#ifdef HAVE_LIBAUDIT
|
|
+#include <libaudit.h>
|
|
+#include <pwd.h>
|
|
+#else
|
|
+#define log_to_audit_system(l,h,s) do { ; } while (0)
|
|
+#endif
|
|
+
|
|
#include <string.h>
|
|
|
|
#if defined(SECURE_RPC) && defined(sun)
|
|
@@ -415,6 +422,29 @@ FailedLogin (struct display *d, const ch
|
|
DrawFail (login);
|
|
}
|
|
|
|
+#ifdef USE_PAM
|
|
+#ifdef HAVE_LIBAUDIT
|
|
+static void
|
|
+log_to_audit_system(const pam_handle_t *pamhp, int success)
|
|
+{
|
|
+ struct passwd *pw = NULL;
|
|
+ char *hostname = NULL, *tty = NULL, *login=NULL;
|
|
+ int audit_fd;
|
|
+
|
|
+ audit_fd = audit_open();
|
|
+ pam_get_item(pamhp, PAM_RHOST, &hostname);
|
|
+ pam_get_item(pamhp, PAM_TTY, &tty);
|
|
+ pam_get_item(pamhp, PAM_USER, &login);
|
|
+ if (login)
|
|
+ pw = getpwnam(login);
|
|
+ audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
|
|
+ NULL, "login", login ? login : "(unknown)",
|
|
+ pw ? pw->pw_uid : -1, hostname, NULL, tty, success);
|
|
+ close(audit_fd);
|
|
+}
|
|
+#endif
|
|
+#endif
|
|
+
|
|
_X_EXPORT
|
|
greet_user_rtn GreetUser(
|
|
struct display *d,
|
|
@@ -600,6 +630,7 @@ greet_user_rtn GreetUser(
|
|
if ((pam_error == PAM_SUCCESS) && (Verify (d, greet, verify))) {
|
|
SetPrompt (login, 1, "Login Successful", LOGIN_TEXT_INFO, False);
|
|
SetValue (login, 1, NULL);
|
|
+ log_to_audit_system(*pamhp, 1);
|
|
break;
|
|
} else {
|
|
/* Try to fill in username for failed login error log */
|
|
@@ -611,6 +642,7 @@ greet_user_rtn GreetUser(
|
|
(void *) &username));
|
|
}
|
|
FailedLogin (d, username);
|
|
+ log_to_audit_system(*pamhp, 0);
|
|
RUN_AND_CHECK_PAM_ERROR(pam_end,
|
|
(*pamhp, pam_error));
|
|
}
|