[LightDM] [PATCH] Add auditing capability

Robert Ancell robert.ancell at gmail.com
Wed Dec 9 20:07:28 PST 2015


Hi Steve,

We already have libaudit support, see:
https://bugs.launchpad.net/bugs/1478087

On Fri, 4 Dec 2015 at 09:39 Steve Grubb <sgrubb at redhat.com> wrote:

> Hello,
>
> In order to correctly audit a user's session, the audit utilities need
> system
> entry points to send an audit event that summarizes if an interactive
> session
> will be allowed. For reference, the expectations are listed here:
>
> http://people.redhat.com/sgrubb/audit/user-login-lifecycle.txt
>
> The patch below adds the sending of this event to lightdm. I have tested
> it as
> applied to lightdm 1.10.5 and seems to be working. In the process I found
> something odd with pam and I'll describe that in a separate email thread.
>
> Signed-off-by: "Steve Grubb" <sgrubb at redhat.com>
>
>
>
>
> diff -urp lightdm-1.10.5.orig/configure.ac lightdm-1.10.5/configure.ac
> --- lightdm-1.10.5.orig/configure.ac    2015-11-13 19:13:06.000000000
> -0500
> +++ lightdm-1.10.5/configure.ac 2015-11-21 11:19:19.355321264 -0500
> @@ -190,6 +190,26 @@ AC_ARG_WITH(greeter-user,
>  AC_SUBST(GREETER_USER)
>  AC_DEFINE_UNQUOTED(GREETER_USER, "$GREETER_USER", User to run greeter as)
>
> +AC_ARG_WITH([audit],
> +    AS_HELP_STRING([--with-audit], [compile with audit support]),
> +    [], [with_audit=no]
> +)
> +
> +if test x$with_audit = xno ; then
> +    have_audit=no;
> +else
> +    AC_CHECK_LIB(audit, audit_log_user_message,
> +        have_audit=yes, have_audit=no)
> +    AS_CASE([$with_audit:$have_audit],
> +        [yes:no],
> +            [AC_MSG_ERROR([Audit selected but libaudit not found (or does
> not support audit_log_user_message())])]
> +    )
> +    if test x$have_audit = xyes ; then
> +        AC_DEFINE(WITH_AUDIT,1,[Define if you want to send login events
> to the audit system.])
> +    fi
> +fi
> +AM_CONDITIONAL(HAVE_AUDIT, test x$have_audit = xyes)
> +
>  dnl
> ###########################################################################
>  dnl Documentation
>  dnl
> ###########################################################################
> diff -urp lightdm-1.10.5.orig/src/Makefile.am
> lightdm-1.10.5/src/Makefile.am
> --- lightdm-1.10.5.orig/src/Makefile.am 2014-04-08 00:30:25.000000000 -0400
> +++ lightdm-1.10.5/src/Makefile.am      2015-11-21 11:16:55.177313574 -0500
> @@ -92,6 +92,10 @@ lightdm_LDADD = \
>         -lgcrypt \
>         -lpam
>
> +if HAVE_AUDIT
> +lightdm_LDADD += -laudit
> +endif
> +
>  dm_tool_SOURCES = \
>         dm-tool.c
>
> diff -urp lightdm-1.10.5.orig/src/session-child.c
> lightdm-1.10.5/src/session-child.c
> --- lightdm-1.10.5.orig/src/session-child.c     2015-11-13
> 19:50:26.000000000 -0500
> +++ lightdm-1.10.5/src/session-child.c  2015-11-21 11:16:55.177313574 -0500
> @@ -16,6 +16,9 @@
>  #include <utmp.h>
>  #include <utmpx.h>
>  #include <sys/mman.h>
> +#ifdef WITH_AUDIT
> +# include <libaudit.h>
> +#endif
>
>  #include "configuration.h"
>  #include "session-child.h"
> @@ -220,6 +223,33 @@ updwtmpx (const gchar *wtmp_file, struct
>      updwtmp (wtmp_file, &u);
>  }
>
> +#ifdef WITH_AUDIT
> +static void log_audit(const struct utmpx *ut, const char *tty, int status)
> +{
> +    int audit_fd;
> +    struct passwd *pwd;
> +
> +    audit_fd = audit_open();
> +    if (audit_fd == -1)
> +        return;
> +    pwd = getpwnam(ut->ut_user);
> +    audit_log_acct_message(audit_fd,
> +         AUDIT_USER_LOGIN,
> +         NULL,
> +         "login",
> +         ut->ut_user ? ut->ut_user : "(unknown)",
> +         pwd ? pwd->pw_uid : (unsigned int) -1,
> +         ut->ut_host,
> +         NULL,
> +         tty,
> +         status);
> +
> +    close(audit_fd);
> +}
> +#else                           /* !WITH_LIBAUDIT */
> +# define log_audit(mut, mtty, mstatus)
> +#endif
> +
>  int
>  session_child_run (int argc, char **argv)
>  {
> @@ -355,7 +385,7 @@ session_child_run (int argc, char **argv
>          if (pam_get_item (pam_handle, PAM_USER, (const void **)
> &new_username) != PAM_SUCCESS)
>          {
>              pam_end (pam_handle, 0);
> -            return EXIT_FAILURE;
> +            goto err_out;
>          }
>          g_free (username);
>          username = g_strdup (new_username);
> @@ -386,6 +416,7 @@ session_child_run (int argc, char **argv
>              ut.ut_tv.tv_usec = tv.tv_usec;
>
>              updwtmpx ("/var/log/btmp", &ut);
> +            log_audit(&ut, tty, 0);
>          }
>
>          /* Check account is valid */
> @@ -442,14 +473,14 @@ session_child_run (int argc, char **argv
>      {
>          g_printerr ("No user selected during authentication\n");
>          pam_end (pam_handle, 0);
> -        return EXIT_FAILURE;
> +        goto err_out;
>      }
>
>      /* Stop if we didn't authenticated */
>      if (authentication_result != PAM_SUCCESS)
>      {
>          pam_end (pam_handle, 0);
> -        return EXIT_FAILURE;
> +        goto err_out;
>      }
>
>      /* Get the command to run (blocks) */
> @@ -482,7 +513,7 @@ session_child_run (int argc, char **argv
>      {
>          pam_setcred (pam_handle, PAM_REINITIALIZE_CRED);
>          pam_end (pam_handle, 0);
> -        return EXIT_SUCCESS;
> +        goto err_out;
>      }
>
>      /* Redirect stderr to a log file */
> @@ -522,7 +553,7 @@ session_child_run (int argc, char **argv
>      {
>          g_printerr ("Failed to establish PAM credentials: %s\n",
> pam_strerror (pam_handle, result));
>          pam_end (pam_handle, 0);
> -        return EXIT_FAILURE;
> +        goto err_out;
>      }
>
>      /* Open the session */
> @@ -531,7 +562,20 @@ session_child_run (int argc, char **argv
>      {
>          g_printerr ("Failed to open PAM session: %s\n", pam_strerror
> (pam_handle, result));
>          pam_end (pam_handle, 0);
> -        return EXIT_FAILURE;
> +        goto err_out;
> +    } else {
> +            /* Write successful login to audit system */
> +            struct utmpx ut;
> +
> +            memset (&ut, 0, sizeof (ut));
> +            if (tty)
> +                strncpy (ut.ut_line, tty + strlen ("/dev/"), sizeof
> (ut.ut_line));
> +            strncpy (ut.ut_user, username, sizeof (ut.ut_user));
> +            if (xdisplay)
> +                strncpy (ut.ut_host, xdisplay, sizeof (ut.ut_host));
> +            else if (remote_host_name)
> +                strncpy (ut.ut_host, remote_host_name, sizeof
> (ut.ut_host));
> +            log_audit(&ut, tty, 1);
>      }
>
>      /* Open a connection to the system bus for ConsoleKit - we must keep
> it open or CK will close the session */
> @@ -775,4 +819,20 @@ session_child_run (int argc, char **argv
>
>      /* Return result of session process to the daemon */
>      return return_code;
> +
> +err_out:
> +    {
> +            struct utmpx ut;
> +
> +            memset (&ut, 0, sizeof (ut));
> +            if (tty)
> +                strncpy (ut.ut_line, tty + strlen ("/dev/"), sizeof
> (ut.ut_line));
> +            strncpy (ut.ut_user, username, sizeof (ut.ut_user));
> +            if (xdisplay)
> +                strncpy (ut.ut_host, xdisplay, sizeof (ut.ut_host));
> +            else if (remote_host_name)
> +                strncpy (ut.ut_host, remote_host_name, sizeof
> (ut.ut_host));
> +            log_audit(&ut, tty, 0);
> +    }
> +    return EXIT_FAILURE;
>  }
>
> _______________________________________________
> LightDM mailing list
> LightDM at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/lightdm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/lightdm/attachments/20151210/b47dd6f7/attachment-0001.html>


More information about the LightDM mailing list