path: root/libpam/pam_account.c
diff options
authorTomas Mraz <>2014-09-05 09:09:37 +0200
committerTomas Mraz <>2014-09-05 09:09:37 +0200
commit0d29e379601819c7f7ed8de18b54de803a9f4049 (patch)
treee9073940dbece1dc7c3b6cf9f5cc9f9b39eaba4a /libpam/pam_account.c
parent8cfc3e7a9aa7f40aeafe58aa88bc1bfca5282afe (diff)
Add grantor field to audit records of libpam.
The grantor field gives audit trail of PAM modules which granted access for successful return from libpam calls. In case of failed return the grantor field is set to '?'. libpam/pam_account.c (pam_acct_mgmt): Remove _pam_auditlog() call. libpam/pam_auth.c (pam_authenticate, pam_setcred): Likewise. libpam/pam_password.c (pam_chauthtok): Likewise. libpam/pam_session.c (pam_open_session, pam_close_session): Likewise. libpam/pam_audit.c (_pam_audit_writelog): Add grantors parameter, add grantor= field to the message if grantors is set. (_pam_list_grantors): New function creating the string with grantors list. (_pam_auditlog): Add struct handler pointer parameter, call _pam_list_grantors() to list the grantors from the handler list. (_pam_audit_end): Add NULL handler parameter to _pam_auditlog() call. (pam_modutil_audit_write): Add NULL grantors parameter to _pam_audit_writelog(). libpam/pam_dispatch.c (_pam_dispatch_aux): Set h->grantor where appropriate. (_pam_clear_grantors): New function to clear grantor field of handler. (_pam_dispatch): Call _pam_clear_grantors() before executing the stack. Call _pam_auditlog() when appropriate. libpam/pam_handlers.c (extract_modulename): Do not allow empty module name or just "?" to avoid confusing audit trail. (_pam_add_handler): Test for NULL return from extract_modulename(). Clear grantor field of handler. libpam/pam_private.h: Add grantor field to struct handler, add handler pointer parameter to _pam_auditlog().
Diffstat (limited to 'libpam/pam_account.c')
1 files changed, 0 insertions, 4 deletions
diff --git a/libpam/pam_account.c b/libpam/pam_account.c
index 572acc47..3a4fb1fc 100644
--- a/libpam/pam_account.c
+++ b/libpam/pam_account.c
@@ -19,9 +19,5 @@ int pam_acct_mgmt(pam_handle_t *pamh, int flags)
retval = _pam_dispatch(pamh, flags, PAM_ACCOUNT);
- retval = _pam_auditlog(pamh, PAM_ACCOUNT, retval, flags);
return retval;