openssh/7.9p1/audit-linux.c

/*
 * Copyright 2010 Red Hat, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
 */

#include "includes.h"
#if defined(USE_LINUX_AUDIT)
#include <libaudit.h>
#include <unistd.h>
#include <string.h>

#include "log.h"
#include "audit.h"
#include "canohost.h"
#include "packet.h"

const char *audit_username(void);

int
linux_audit_record_event(int uid, const char *username, const char *hostname,
    const char *ip, const char *ttyn, int success)
{
        int audit_fd, rc, saved_errno;

        if ((audit_fd = audit_open()) < 0) {
                if (errno == EINVAL || errno == EPROTONOSUPPORT ||
                    errno == EAFNOSUPPORT)
                        return 1; /* No audit support in kernel */
                else
                        return 0; /* Must prevent login */
        }
        rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
            NULL, "login", username ? username : "(unknown)",
            username == NULL ? uid : -1, hostname, ip, ttyn, success);
        saved_errno = errno;
        close(audit_fd);

        /*
         * Do not report error if the error is EPERM and sshd is run as non
         * root user.
         */
        if ((rc == -EPERM) && (geteuid() != 0))
                rc = 0;
        errno = saved_errno;

        return rc >= 0;
}

/* Below is the sshd audit API code */

void
audit_connection_from(const char *host, int port)
{
        /* not implemented */
}

void
audit_run_command(const char *command)
{
        /* not implemented */
}

void
audit_session_open(struct logininfo *li)
{
        if (linux_audit_record_event(li->uid, NULL, li->hostname, NULL,
            li->line, 1) == 0)
                fatal("linux_audit_write_entry failed: %s", strerror(errno));
}

void
audit_session_close(struct logininfo *li)
{
        /* not implemented */
}

void
audit_event(ssh_audit_event_t event)
{
        struct ssh *ssh = active_state; /* XXX */

        switch(event) {
        case SSH_AUTH_SUCCESS:
        case SSH_CONNECTION_CLOSE:
        case SSH_NOLOGIN:
        case SSH_LOGIN_EXCEED_MAXTRIES:
        case SSH_LOGIN_ROOT_DENIED:
                break;
        case SSH_AUTH_FAIL_NONE:
        case SSH_AUTH_FAIL_PASSWD:
        case SSH_AUTH_FAIL_KBDINT:
        case SSH_AUTH_FAIL_PUBKEY:
        case SSH_AUTH_FAIL_HOSTBASED:
        case SSH_AUTH_FAIL_GSSAPI:
        case SSH_INVALID_USER:
                linux_audit_record_event(-1, audit_username(), NULL,
                    ssh_remote_ipaddr(ssh), "sshd", 0);
                break;
        default:
                debug("%s: unhandled event %d", __func__, event);
                break;
        }
}
#endif /* USE_LINUX_AUDIT */
Revision:	12211
Committed:	Sat Jun 29 01:39:44 2019 UTC (4 years, 10 months ago) by laffer1
Content type:	text/plain
File size:	3546 byte(s)
Log Message:	tag 7.9p1
#	Content
1	/*
2	* Copyright 2010 Red Hat, Inc. All rights reserved.
3	* Use is subject to license terms.
4	*
5	* Redistribution and use in source and binary forms, with or without
6	* modification, are permitted provided that the following conditions
7	* are met:
8	* 1. Redistributions of source code must retain the above copyright
9	* notice, this list of conditions and the following disclaimer.
10	* 2. Redistributions in binary form must reproduce the above copyright
11	* notice, this list of conditions and the following disclaimer in the
12	* documentation and/or other materials provided with the distribution.
13	*
14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24	*
25	* Red Hat author: Jan F. Chadima <jchadima@redhat.com>
26	*/
27
28	#include "includes.h"
29	#if defined(USE_LINUX_AUDIT)
30	#include <libaudit.h>
31	#include <unistd.h>
32	#include <string.h>
33
34	#include "log.h"
35	#include "audit.h"
36	#include "canohost.h"
37	#include "packet.h"
38
39	const char *audit_username(void);
40
41	int
42	linux_audit_record_event(int uid, const char username, const char hostname,
43	const char ip, const char ttyn, int success)
44	{
45	int audit_fd, rc, saved_errno;
46
47	if ((audit_fd = audit_open()) < 0) {
48	if (errno == EINVAL \|\| errno == EPROTONOSUPPORT \|\|
49	errno == EAFNOSUPPORT)
50	return 1; /* No audit support in kernel */
51	else
52	return 0; /* Must prevent login */
53	}
54	rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
55	NULL, "login", username ? username : "(unknown)",
56	username == NULL ? uid : -1, hostname, ip, ttyn, success);
57	saved_errno = errno;
58	close(audit_fd);
59
60	/*
61	* Do not report error if the error is EPERM and sshd is run as non
62	* root user.
63	*/
64	if ((rc == -EPERM) && (geteuid() != 0))
65	rc = 0;
66	errno = saved_errno;
67
68	return rc >= 0;
69	}
70
71	/* Below is the sshd audit API code */
72
73	void
74	audit_connection_from(const char *host, int port)
75	{
76	/* not implemented */
77	}
78
79	void
80	audit_run_command(const char *command)
81	{
82	/* not implemented */
83	}
84
85	void
86	audit_session_open(struct logininfo *li)
87	{
88	if (linux_audit_record_event(li->uid, NULL, li->hostname, NULL,
89	li->line, 1) == 0)
90	fatal("linux_audit_write_entry failed: %s", strerror(errno));
91	}
92
93	void
94	audit_session_close(struct logininfo *li)
95	{
96	/* not implemented */
97	}
98
99	void
100	audit_event(ssh_audit_event_t event)
101	{
102	struct ssh ssh = active_state; / XXX */
103
104	switch(event) {
105	case SSH_AUTH_SUCCESS:
106	case SSH_CONNECTION_CLOSE:
107	case SSH_NOLOGIN:
108	case SSH_LOGIN_EXCEED_MAXTRIES:
109	case SSH_LOGIN_ROOT_DENIED:
110	break;
111	case SSH_AUTH_FAIL_NONE:
112	case SSH_AUTH_FAIL_PASSWD:
113	case SSH_AUTH_FAIL_KBDINT:
114	case SSH_AUTH_FAIL_PUBKEY:
115	case SSH_AUTH_FAIL_HOSTBASED:
116	case SSH_AUTH_FAIL_GSSAPI:
117	case SSH_INVALID_USER:
118	linux_audit_record_event(-1, audit_username(), NULL,
119	ssh_remote_ipaddr(ssh), "sshd", 0);
120	break;
121	default:
122	debug("%s: unhandled event %d", __func__, event);
123	break;
124	}
125	}
126	#endif /* USE_LINUX_AUDIT */