diff options
Diffstat (limited to 'audit-linux.c')
| -rw-r--r-- | audit-linux.c | 30 |
1 files changed, 14 insertions, 16 deletions
diff --git a/audit-linux.c b/audit-linux.c index b3ee2f4d..3fcbe5c5 100644 --- a/audit-linux.c +++ b/audit-linux.c @@ -1,5 +1,3 @@ -/* $Id: audit-linux.c,v 1.1 2011/01/17 10:15:30 dtucker Exp $ */ - /* * Copyright 2010 Red Hat, Inc. All rights reserved. * Use is subject to license terms. @@ -36,17 +34,17 @@ #include "log.h" #include "audit.h" #include "canohost.h" +#include "packet.h" -const char* audit_username(void); +const char *audit_username(void); int -linux_audit_record_event(int uid, const char *username, - const char *hostname, const char *ip, const char *ttyn, int success) +linux_audit_record_event(int uid, const char *username, const char *hostname, + const char *ip, const char *ttyn, int success) { int audit_fd, rc, saved_errno; - audit_fd = audit_open(); - if (audit_fd < 0) { + if ((audit_fd = audit_open()) < 0) { if (errno == EINVAL || errno == EPROTONOSUPPORT || errno == EAFNOSUPPORT) return 1; /* No audit support in kernel */ @@ -58,6 +56,7 @@ linux_audit_record_event(int uid, const char *username, username == NULL ? uid : -1, hostname, ip, ttyn, success); saved_errno = errno; close(audit_fd); + /* * Do not report error if the error is EPERM and sshd is run as non * root user. @@ -65,7 +64,8 @@ linux_audit_record_event(int uid, const char *username, if ((rc == -EPERM) && (geteuid() != 0)) rc = 0; errno = saved_errno; - return (rc >= 0); + + return rc >= 0; } /* Below is the sshd audit API code */ @@ -73,8 +73,8 @@ linux_audit_record_event(int uid, const char *username, void audit_connection_from(const char *host, int port) { -} /* not implemented */ +} void audit_run_command(const char *command) @@ -85,8 +85,8 @@ audit_run_command(const char *command) void audit_session_open(struct logininfo *li) { - if (linux_audit_record_event(li->uid, NULL, li->hostname, - NULL, li->line, 1) == 0) + if (linux_audit_record_event(li->uid, NULL, li->hostname, NULL, + li->line, 1) == 0) fatal("linux_audit_write_entry failed: %s", strerror(errno)); } @@ -97,7 +97,7 @@ audit_session_close(struct logininfo *li) } void -audit_event(ssh_audit_event_t event) +audit_event(struct ssh *ssh, ssh_audit_event_t event) { switch(event) { case SSH_AUTH_SUCCESS: @@ -106,7 +106,6 @@ audit_event(ssh_audit_event_t event) case SSH_LOGIN_EXCEED_MAXTRIES: case SSH_LOGIN_ROOT_DENIED: break; - case SSH_AUTH_FAIL_NONE: case SSH_AUTH_FAIL_PASSWD: case SSH_AUTH_FAIL_KBDINT: @@ -115,12 +114,11 @@ audit_event(ssh_audit_event_t event) case SSH_AUTH_FAIL_GSSAPI: case SSH_INVALID_USER: linux_audit_record_event(-1, audit_username(), NULL, - get_remote_ipaddr(), "sshd", 0); + ssh_remote_ipaddr(ssh), "sshd", 0); break; - default: debug("%s: unhandled event %d", __func__, event); + break; } } - #endif /* USE_LINUX_AUDIT */ |