>From b88f0a31ef5ca56065d0a7db734f310c2fadaadd Mon Sep 17 00:00:00 2001
From: Michal Zidek <mzidek@redhat.com>
Date: Tue, 12 Aug 2014 08:27:38 -0400
Subject: [PATCH 1/2] AUDIT: Add audit support for SSSD

This patch adds helper wrapper macros for audit_open
and audit_log_acct_message.

Part of:
https://fedorahosted.org/sssd/ticket/2373
https://fedorahosted.org/sssd/ticket/2372
---
 Makefile.am          |  1 +
 configure.ac         |  5 +++++
 src/conf_macros.m4   | 17 +++++++++++++++++
 src/util/sss_audit.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 src/util/sss_audit.h | 31 +++++++++++++++++++++++++++++++
 5 files changed, 105 insertions(+)
 create mode 100644 src/util/sss_audit.c
 create mode 100644 src/util/sss_audit.h

diff --git a/Makefile.am b/Makefile.am
index 6707711..35777b2 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -473,6 +473,7 @@ dist_noinst_HEADERS = \
     src/util/sss_ini.h \
     src/util/sss_format.h \
     src/util/sss_config.h \
+    src/util/sss_audit.h \
     src/util/refcount.h \
     src/util/find_uid.h \
     src/util/user_info_msg.h \
diff --git a/configure.ac b/configure.ac
index 3865421..68ed66e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -123,6 +123,7 @@ WITH_IFP
 WITH_CRYPTO
 WITH_SYSLOG
 WITH_SAMBA
+WITH_LIBAUDIT
 
 m4_include([src/external/pkg.m4])
 m4_include([src/external/libpopt.m4])
@@ -161,6 +162,10 @@ if test x$build_config_lib = xyes; then
     m4_include([src/external/libaugeas.m4])
 fi
 
+if test x"$with_libaudit" = xyes; then
+    m4_include([src/external/libaudit.m4])
+fi
+
 WITH_UNICODE_LIB
 if test x$unicode_lib = xlibunistring; then
     m4_include([src/external/libunistring.m4])
diff --git a/src/conf_macros.m4 b/src/conf_macros.m4
index 3c9827b..55a6f83 100644
--- a/src/conf_macros.m4
+++ b/src/conf_macros.m4
@@ -685,6 +685,23 @@ AC_DEFUN([WITH_SAMBA],
     AM_CONDITIONAL([BUILD_SAMBA], [test x"$with_samba" = xyes])
   ])
 
+AC_DEFUN([WITH_LIBAUDIT],
+  [ AC_ARG_WITH([libaudit],
+                [AC_HELP_STRING([--with-libaudit],
+                                [Whether to build with libaudit libraries [yes]]
+                               )
+                ],
+                [with_libaudit=$withval],
+                [with_libaudit=no]
+               )
+
+    if test x"$with_libaudit" = xyes; then
+        AC_DEFINE(BUILD_LIBAUDIT, 1, [whether to build with libaudit support])
+    fi
+    AM_CONDITIONAL([BUILD_LIBAUDIT], [test x"$with_libaudit" = xyes])
+  ])
+
+
 AC_ARG_ENABLE([dbus-tests],
               [AS_HELP_STRING([--enable-dbus-tests],
                               [enable running tests using a dbus server instance [default=yes]])],
diff --git a/src/util/sss_audit.c b/src/util/sss_audit.c
new file mode 100644
index 0000000..cb2bed3
--- /dev/null
+++ b/src/util/sss_audit.c
@@ -0,0 +1,51 @@
+#include "src/util/util.h"
+
+#ifdef BUILD_LIBAUDIT
+
+#include <libaudit.h>
+
+int sss_audit_fd;
+
+void _sss_audit_init(void)
+{
+    errno_t err;
+
+    sss_audit_fd = audit_open();
+    if (sss_audit_fd == -1) {
+        err = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Unable to itialize auditing: [%d]: %s\n",
+              err, strerror(err));
+    }
+}
+
+void _sss_audit_acct(int type,
+                     const char *op,
+                     const char *name,
+                     unsigned int id,
+                     int result)
+{
+    errno_t ret;
+
+    if (sss_audit_fd == -1) {
+        /* No auditing. */
+        return;
+    } else {
+        ret = audit_log_acct_message(sss_audit_fd,
+                                     type,
+                                     NULL, /* program name */
+                                     op,
+                                     name,
+                                     id,
+                                     NULL, /* host */
+                                     NULL, /* addr */
+                                     NULL, /* tty */
+                                     result);
+        if (ret <= 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "audit_log_acct_message failed\n");
+        }
+    }
+}
+
+#else
+#endif
diff --git a/src/util/sss_audit.h b/src/util/sss_audit.h
new file mode 100644
index 0000000..0844c7f
--- /dev/null
+++ b/src/util/sss_audit.h
@@ -0,0 +1,31 @@
+#ifndef _SSS_AUDIT_H_
+#define _SSS_AUDIT_H_
+
+#define SSS_AUDIT_FAILURE 0
+#define SSS_AUDIT_SUCCESS 1
+#define SSS_AUDIT_NO_ID ((unsigned int) -1)
+
+#ifdef BUILD_LIBAUDIT
+
+#include <libaudit.h>
+
+#define SSS_AUDIT_INIT() \
+    _sss_audit_init()
+#define SSS_AUDIT_ACCT(type, op, name, id, result) \
+    _sss_audit_acct(type, op, name, id, result)
+
+void _sss_audit_init(void);
+
+void _sss_audit_acct(int type,
+                     const char *op,
+                     const char *name,
+                     unsigned int id,
+                     int result);
+
+#else /* BUIL_LIBAUDIT */
+
+#define SSS_AUDIT_INIT()
+#define SSS_AUDIT_ACCT(type, op, name, id, result)
+
+#endif /* BUILD_LIBAUDIT */
+#endif /* _SSS_AUDIT_H_ */
-- 
1.7.11.2

