>From 2d84800b5f66d5bbc2be3f444e82e959300b2bb2 Mon Sep 17 00:00:00 2001
From: Michal Zidek <mzidek@redhat.com>
Date: Thu, 25 Sep 2014 18:05:02 +0200
Subject: [PATCH 1/2] AUDIT: Add audit support for SSSD

This patch adds helper wrapper macros for audit_open
and audit_log_acct_message.

Part of:
https://fedorahosted.org/sssd/ticket/2373
---
 Makefile.am              | 13 ++++++++
 configure.ac             |  5 +++
 contrib/sssd.spec.in     |  1 +
 src/conf_macros.m4       | 16 +++++++++
 src/external/libaudit.m4 |  9 +++++
 src/tests/dlopen-tests.c |  1 +
 src/util/sss_audit.c     | 86 ++++++++++++++++++++++++++++++++++++++++++++++++
 src/util/sss_audit.h     | 46 ++++++++++++++++++++++++++
 src/util/util.h          |  1 +
 9 files changed, 178 insertions(+)
 create mode 100644 src/external/libaudit.m4
 create mode 100644 src/util/sss_audit.c
 create mode 100644 src/util/sss_audit.h

diff --git a/Makefile.am b/Makefile.am
index b85341f..83d1c90 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -510,6 +510,7 @@ dist_noinst_HEADERS = \
     src/util/sss_ini.h \
     src/util/sss_format.h \
     src/util/sss_config.h \
+    src/util/sss_audit.h \
     src/util/refcount.h \
     src/util/find_uid.h \
     src/util/user_info_msg.h \
@@ -653,6 +654,17 @@ endif
 #####################
 # Utility libraries #
 #####################
+pkglib_LTLIBRARIES += libsss_audit.la
+libsss_audit_la_SOURCES = \
+    src/util/sss_audit.c \
+    $(NULL)
+libsss_audit_la_LIBADD = \
+    libsss_debug.la \
+    $(AUDIT_LIBS) \
+	$(NULL)
+libsss_audit_la_LDFLAGS = \
+    -avoid-version
+
 pkglib_LTLIBRARIES += libsss_debug.la
 libsss_debug_la_SOURCES = \
     src/util/debug.c \
@@ -759,6 +771,7 @@ SSSD_INTERNAL_LTLIBS = \
     libsss_crypt.la \
     libsss_debug.la \
     libsss_child.la \
+    libsss_audit.la \
     $(NULL)
 
 if BUILD_IFP
diff --git a/configure.ac b/configure.ac
index e5ec204..7828d06 100644
--- a/configure.ac
+++ b/configure.ac
@@ -138,6 +138,7 @@ WITH_NFS
 WITH_NFS_LIB_PATH
 WITH_LIBWBCLIENT
 WITH_SSSD_USER
+WITH_LIBAUDIT
 
 m4_include([src/external/pkg.m4])
 m4_include([src/external/libpopt.m4])
@@ -178,6 +179,10 @@ if test x$build_config_lib = xyes; then
     m4_include([src/external/libaugeas.m4])
 fi
 
+if test x"$with_libaudit" = xyes; then
+    m4_include([src/external/libaudit.m4])
+fi
+
 WITH_UNICODE_LIB
 if test x$unicode_lib = xlibunistring; then
     m4_include([src/external/libunistring.m4])
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 5bfb167..303d2e1 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -590,6 +590,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/%{name}/libsss_ldap_common.so
 %{_libdir}/%{name}/libsss_util.so
 %{_libdir}/%{name}/libsss_semanage.so
+%{_libdir}/%{name}/libsss_audit.so
 
 # 3rd party application libraries
 %{_libdir}/sssd/modules/libsss_autofs.so
diff --git a/src/conf_macros.m4 b/src/conf_macros.m4
index fbee81f..1013931 100644
--- a/src/conf_macros.m4
+++ b/src/conf_macros.m4
@@ -701,6 +701,22 @@ AC_DEFUN([WITH_SAMBA],
     AM_CONDITIONAL([BUILD_SAMBA], [test x"$with_samba" = xyes])
   ])
 
+AC_DEFUN([WITH_LIBAUDIT],
+  [ AC_ARG_WITH([libaudit],
+                [AC_HELP_STRING([--with-libaudit],
+                                [Whether to build with libaudit libraries [yes]]
+                               )
+                ],
+                [with_libaudit=$withval],
+                [with_libaudit=no]
+               )
+
+    if test x"$with_libaudit" = xyes; then
+        AC_DEFINE(BUILD_LIBAUDIT, 1, [whether to build with libaudit support])
+    fi
+    AM_CONDITIONAL([BUILD_LIBAUDIT], [test x"$with_libaudit" = xyes])
+  ])
+
 AC_ARG_ENABLE([dbus-tests],
               [AS_HELP_STRING([--enable-dbus-tests],
                               [enable running tests using a dbus server instance [default=yes]])],
diff --git a/src/external/libaudit.m4 b/src/external/libaudit.m4
new file mode 100644
index 0000000..28bad46
--- /dev/null
+++ b/src/external/libaudit.m4
@@ -0,0 +1,9 @@
+AC_SUBST(AUDIT_LIBS)
+
+AC_CHECK_HEADER([libaudit.h],
+    [AC_CHECK_LIB([audit],
+                  [audit_open],
+                  [AUDIT_LIBS="-laudit"],
+                  [AC_MSG_ERROR([libaudit missing audit_open])], [] )],
+    [AC_MSG_ERROR([libaudit not found. To compile SSSD without libaudit support, run configure with --without-libaudit option.])]
+)
diff --git a/src/tests/dlopen-tests.c b/src/tests/dlopen-tests.c
index 7e56d65..3c591cd 100644
--- a/src/tests/dlopen-tests.c
+++ b/src/tests/dlopen-tests.c
@@ -38,6 +38,7 @@ struct so {
     const char *libs[6];
 } so[] = {
     { "libsss_debug.so", { LIBPFX"libsss_debug.so", NULL } },
+    { "libsss_audit.so", { LIBPFX"libsss_audit.so", NULL } },
     { "libsss_semanage.so", { LIBPFX"libsss_semanage.so", NULL } },
     { "libipa_hbac.so", { LIBPFX"libipa_hbac.so", NULL } },
     { "libsss_idmap.so", { LIBPFX"libsss_idmap.so", NULL } },
diff --git a/src/util/sss_audit.c b/src/util/sss_audit.c
new file mode 100644
index 0000000..a4a25cd
--- /dev/null
+++ b/src/util/sss_audit.c
@@ -0,0 +1,86 @@
+/*
+    Authors:
+        Michal Zidek <mzidek@redhat.com>
+
+    Copyright (C) 2014 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "src/util/util.h"
+
+#ifdef BUILD_LIBAUDIT
+
+#include <libaudit.h>
+
+int sss_audit_fd;
+
+void sss_audit_init(void)
+{
+    errno_t err;
+
+    sss_audit_fd = audit_open();
+    if (sss_audit_fd == -1) {
+        err = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Unable to itialize auditing: [%d]: %s\n",
+              err, strerror(err));
+    }
+}
+
+void sss_audit_acct(int type,
+                    const char *op,
+                    const char *name,
+                    unsigned int id,
+                    int result)
+{
+    errno_t ret;
+
+    if (sss_audit_fd == -1) {
+        /* No auditing. */
+        return;
+    } else {
+        ret = audit_log_acct_message(sss_audit_fd,
+                                     type,
+                                     NULL, /* program name */
+                                     op,
+                                     name,
+                                     id,
+                                     NULL, /* host */
+                                     NULL, /* addr */
+                                     NULL, /* tty */
+                                     result);
+        if (ret <= 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "audit_log_acct_message failed\n");
+        }
+    }
+}
+
+#else /*BUILD_LIBAUDIT*/
+
+void sss_audit_init(void)
+{
+    return;
+}
+
+void sss_audit_acct(int type,
+                    const char *op,
+                    const char *name,
+                    unsigned int id,
+                    int result)
+{
+    return;
+}
+
+#endif /* BUILD_LIBAUDIT */
diff --git a/src/util/sss_audit.h b/src/util/sss_audit.h
new file mode 100644
index 0000000..f99c0a1
--- /dev/null
+++ b/src/util/sss_audit.h
@@ -0,0 +1,46 @@
+/*
+    Authors:
+        Michal Zidek <mzidek@redhat.com>
+
+    Copyright (C) 2014 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _SSS_AUDIT_H_
+#define _SSS_AUDIT_H_
+
+#define SSS_AUDIT_FAILURE 0
+#define SSS_AUDIT_SUCCESS 1
+#define SSS_AUDIT_NO_ID ((unsigned int) -1)
+
+#ifdef BUILD_LIBAUDIT
+#include <libaudit.h>
+#else
+/* Enumerate all libaudit message types that we use across SSSD
+ * for the case when libaudit.h is not available. */
+enum {
+    AUDIT_ADD_USER
+};
+#endif
+
+void sss_audit_init(void);
+
+void sss_audit_acct(int type,
+                    const char *op,
+                    const char *name,
+                    unsigned int id,
+                    int result);
+
+#endif /* _SSS_AUDIT_H_ */
diff --git a/src/util/util.h b/src/util/util.h
index ffc8a87..2cf0bf3 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -50,6 +50,7 @@
 #include "util/util_errors.h"
 #include "util/util_safealign.h"
 #include "util/sss_format.h"
+#include "util/sss_audit.h"
 
 #define _(STRING) gettext (STRING)
 
-- 
1.9.3

