New upstream version 0.99.8.1

1 files changed, 21 insertions, 10 deletions

diff --git a/Linux-PAM/libpam/pam_audit.c b/Linux-PAM/libpam/pam_audit.c
index ff1486aa..240d4a89 100644
--- a/Linux-PAM/libpam/pam_audit.c
+++ b/Linux-PAM/libpam/pam_audit.c
@@ -14,6 +14,7 @@
 #include <libaudit.h>
 #include <pwd.h>
 #include <netdb.h>
+#include <unistd.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
@@ -27,22 +28,32 @@ _pam_audit_writelog(pam_handle_t *pamh, int audit_fd, int type,
 {
   static int old_errno = -1;
   int rc;
-  char buf[256];
+  char buf[32];
 
-  snprintf(buf, sizeof(buf), "PAM: %s acct=%s ", message,
-	(retval != PAM_USER_UNKNOWN && pamh->user) ? pamh->user : "?");
+  snprintf(buf, sizeof(buf), "PAM:%s", message);
 
-  rc = audit_log_user_message( audit_fd, type, buf,
-        pamh->rhost, NULL, pamh->tty, retval == PAM_SUCCESS );
+  rc = audit_log_acct_message (audit_fd, type, NULL, buf,
+       (retval != PAM_USER_UNKNOWN && pamh->user) ? pamh->user : "?",
+	-1, pamh->rhost, NULL, pamh->tty, retval == PAM_SUCCESS );
 
-  if (rc == -1 && errno != old_errno)
+  /* libaudit sets errno to his own negative error code. This can be
+     an official errno number, but must not. It can also be a audit
+     internal error code. Which makes errno useless :-((. Try the
+     best to fix it. */
+  errno = -rc;
+
+  if (rc < 0 && errno != old_errno)
     {
       old_errno = errno;
-      pam_syslog(pamh, LOG_CRIT, "audit_log_user_message() failed: %m");
+      pam_syslog (pamh, LOG_CRIT, "audit_log_acct_message() failed: %m");
     }
 
   pamh->audit_state |= PAMAUDIT_LOGGED;
-  return rc;
+
+  if (rc == -EPERM && getuid () != 0)
+    return 0;
+  else
+    return rc;
 }
 
 int
@@ -73,11 +84,11 @@ _pam_auditlog(pam_handle_t *pamh, int action, int retval, int flags)
     type = AUDIT_USER_AUTH;
     break;
   case PAM_OPEN_SESSION:
-    message = "session open";
+    message = "session_open";
     type = AUDIT_USER_START;
     break;
   case PAM_CLOSE_SESSION:
-    message = "session close";
+    message = "session_close";
     type = AUDIT_USER_END;
     break;
   case PAM_ACCOUNT: