diff options
Diffstat (limited to 'Linux-PAM/libpam/pam_audit.c')
| -rw-r--r-- | Linux-PAM/libpam/pam_audit.c | 31 |
1 files changed, 21 insertions, 10 deletions
diff --git a/Linux-PAM/libpam/pam_audit.c b/Linux-PAM/libpam/pam_audit.c index ff1486aa..240d4a89 100644 --- a/Linux-PAM/libpam/pam_audit.c +++ b/Linux-PAM/libpam/pam_audit.c @@ -14,6 +14,7 @@ #include <libaudit.h> #include <pwd.h> #include <netdb.h> +#include <unistd.h> #include <sys/types.h> #include <sys/socket.h> #include <arpa/inet.h> @@ -27,22 +28,32 @@ _pam_audit_writelog(pam_handle_t *pamh, int audit_fd, int type, { static int old_errno = -1; int rc; - char buf[256]; + char buf[32]; - snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message, - (retval != PAM_USER_UNKNOWN && pamh->user) ? pamh->user : "?"); + snprintf(buf, sizeof(buf), "PAM:%s", message); - rc = audit_log_user_message( audit_fd, type, buf, - pamh->rhost, NULL, pamh->tty, retval == PAM_SUCCESS ); + rc = audit_log_acct_message (audit_fd, type, NULL, buf, + (retval != PAM_USER_UNKNOWN && pamh->user) ? pamh->user : "?", + -1, pamh->rhost, NULL, pamh->tty, retval == PAM_SUCCESS ); - if (rc == -1 && errno != old_errno) + /* libaudit sets errno to his own negative error code. This can be + an official errno number, but must not. It can also be a audit + internal error code. Which makes errno useless :-((. Try the + best to fix it. */ + errno = -rc; + + if (rc < 0 && errno != old_errno) { old_errno = errno; - pam_syslog(pamh, LOG_CRIT, "audit_log_user_message() failed: %m"); + pam_syslog (pamh, LOG_CRIT, "audit_log_acct_message() failed: %m"); } pamh->audit_state |= PAMAUDIT_LOGGED; - return rc; + + if (rc == -EPERM && getuid () != 0) + return 0; + else + return rc; } int @@ -73,11 +84,11 @@ _pam_auditlog(pam_handle_t *pamh, int action, int retval, int flags) type = AUDIT_USER_AUTH; break; case PAM_OPEN_SESSION: - message = "session open"; + message = "session_open"; type = AUDIT_USER_START; break; case PAM_CLOSE_SESSION: - message = "session close"; + message = "session_close"; type = AUDIT_USER_END; break; case PAM_ACCOUNT: |