diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2013-06-21 08:29:00 -0400 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@altlinux.org> | 2013-06-21 21:36:20 +0000 |
| commit | 333686501468f66160c8eb50ae23f1dc08b82e12 (patch) | |
| tree | a6adc46e5ecddac9bea683f4b0ffb0db6621978f /configure.in | |
| parent | 43a69398c33f8580c5925953fa7ee561666d8e33 (diff) | |
| download | pam-333686501468f66160c8eb50ae23f1dc08b82e12.tar.gz pam-333686501468f66160c8eb50ae23f1dc08b82e12.tar.bz2 pam-333686501468f66160c8eb50ae23f1dc08b82e12.zip | |
pam_tty_audit: add an option to control logging of passwords: log_passwd
Most commands are entered one line at a time and processed as complete lines
in non-canonical mode. Commands that interactively require a password, enter
canonical mode with echo set to off to do this. This feature (icanon and
!echo) can be used to avoid logging passwords by audit while still logging the
rest of the command. Adding a member to the struct audit_tty_status passed in
by pam_tty_audit allows control of logging passwords per task.
* configure.in: autoconf bits to conditionally add support at compile time
depending on struct audit_tty_status kernel header version.
* modules/pam_tty_audit/pam_tty_audit.8.xml: Document new pam_tty_audit module
log_passwd option.
* modules/pam_tty_audit/pam_tty_audit.c: (pam_sm_open_session): Added
"log_passwd" option parsing.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Diffstat (limited to 'configure.in')
| -rw-r--r-- | configure.in | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/configure.in b/configure.in index 515b3011..b92d9ac0 100644 --- a/configure.in +++ b/configure.in @@ -386,6 +386,10 @@ if test x"$WITH_LIBAUDIT" != xno ; then fi if test ! -z "$HAVE_AUDIT_TTY_STATUS" ; then AC_DEFINE([HAVE_AUDIT_TTY_STATUS], 1, [Define to 1 if struct audit_tty_status exists.]) + + AC_CHECK_MEMBERS([struct audit_tty_status.log_passwd], [], + AC_MSG_WARN([audit_tty_status.log_passwd is not available. The log_passwd option is disabled.]), + [[#include <libaudit.h>]]) fi else LIBAUDIT="" @@ -393,6 +397,8 @@ fi AC_SUBST(LIBAUDIT) AM_CONDITIONAL([HAVE_AUDIT_TTY_STATUS], [test "x$HAVE_AUDIT_TTY_STATUS" = xyes]) +AM_CONDITIONAL([HAVE_AUDIT_TTY_STATUS_LOG_PASSWD], + [test "x$ac_cv_member_audit_tty_status_log_passwd" = xyes]) AC_CHECK_HEADERS(xcrypt.h crypt.h) AS_IF([test "x$ac_cv_header_xcrypt_h" = "xyes"], |