From 32112a7b6075e23d7acba37b9272be4a3926bd33 Mon Sep 17 00:00:00 2001
From: Christian Göttsche <cgzones@googlemail.com>
Date: Mon, 15 Jan 2024 16:20:52 +0100
Subject: pam_unix: refactor audit logging

Split the audit logging code into a separate file, to be reused by
unix_update(8).
---
 modules/pam_unix/audit.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 modules/pam_unix/audit.c

(limited to 'modules/pam_unix/audit.c')

diff --git a/modules/pam_unix/audit.c b/modules/pam_unix/audit.c
new file mode 100644
index 00000000..1547a652
--- /dev/null
+++ b/modules/pam_unix/audit.c
@@ -0,0 +1,45 @@
+#include "audit.h"
+
+#include "config.h"
+
+#ifdef HAVE_LIBAUDIT
+
+#include <errno.h>
+#include <unistd.h>
+
+#include <libaudit.h>
+
+#include <security/_pam_types.h>
+
+#include "passverify.h"
+
+int audit_log(int type, const char *uname, int retval)
+{
+	int audit_fd, rc;
+
+	audit_fd = audit_open();
+	if (audit_fd < 0) {
+		/* You get these error codes only when the kernel doesn't have
+		 * audit compiled in. */
+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
+		    errno == EAFNOSUPPORT)
+			return PAM_SUCCESS;
+
+		helper_log_err(LOG_CRIT, "audit_open() failed: %m");
+		return PAM_AUTH_ERR;
+	}
+
+
+
+	rc = audit_log_acct_message(audit_fd, type, NULL, "PAM:" HELPER_COMPILE,
+		uname, -1, NULL, NULL, NULL, retval == PAM_SUCCESS);
+	if (rc == -EPERM && geteuid() != 0) {
+		rc = 0;
+	}
+
+	audit_close(audit_fd);
+
+	return rc < 0 ? PAM_AUTH_ERR : PAM_SUCCESS;
+}
+
+#endif /* HAVE_LIBAUDIT */
-- 
cgit v1.2.3