>From d2b5a3f86594b1bc5d965117572058751f9d6e1a Mon Sep 17 00:00:00 2001
From: Michal Zidek <mzidek@redhat.com>
Date: Tue, 12 Aug 2014 08:33:14 -0400
Subject: [PATCH 2/2] AUDIT: audit requirements for sss_useradd

Added audit support for sss_useradd.

Part of:
https://fedorahosted.org/sssd/ticket/2373
---
 Makefile.am             |  2 ++
 src/tools/sss_useradd.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 35777b2..18596ef 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -994,9 +994,11 @@ dist_noinst_DATA += \
 ######################
 sss_useradd_SOURCES = \
     src/tools/sss_useradd.c \
+    src/util/sss_audit.c \
     $(SSSD_TOOLS_OBJ)
 sss_useradd_LDADD = \
     $(TOOLS_LIBS) \
+    $(AUDIT_LIBS) \
     $(SSSD_INTERNAL_LTLIBS)
 
 sss_userdel_SOURCES = \
diff --git a/src/tools/sss_useradd.c b/src/tools/sss_useradd.c
index 5943940..a962133 100644
--- a/src/tools/sss_useradd.c
+++ b/src/tools/sss_useradd.c
@@ -28,6 +28,7 @@
 #include <unistd.h>
 
 #include "util/util.h"
+#include "util/sss_audit.h"
 #include "db/sysdb.h"
 #include "tools/tools_util.h"
 #include "tools/sss_sync_ops.h"
@@ -64,9 +65,12 @@ int main(int argc, const char **argv)
     int ret;
     errno_t sret;
     bool in_transaction = false;
+    bool user_added = false;
 
     debug_prg_name = argv[0];
 
+    SSS_AUDIT_INIT();
+
     ret = set_locale();
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE,
@@ -122,6 +126,8 @@ int main(int argc, const char **argv)
         } else {
             ERROR("Error initializing the tools\n");
         }
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "initializing the tools",
+                       pc_username, SSS_AUDIT_NO_ID, SSS_AUDIT_FAILURE);
         ret = EXIT_FAILURE;
         goto fini;
     }
@@ -130,6 +136,8 @@ int main(int argc, const char **argv)
     ret = parse_name_domain(tctx, pc_username);
     if (ret != EOK) {
         ERROR("Invalid domain specified in FQDN\n");
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "parsing domain",
+                       pc_username, SSS_AUDIT_NO_ID, SSS_AUDIT_FAILURE);
         ret = EXIT_FAILURE;
         goto fini;
     }
@@ -140,6 +148,9 @@ int main(int argc, const char **argv)
             DEBUG(SSSDBG_CRIT_FAILURE,
                   "Cannot parse groups to add the user to\n");
             ERROR("Internal error while parsing parameters\n");
+            SSS_AUDIT_ACCT(AUDIT_ADD_USER, "parsing groups",
+                           tctx->octx->name, SSS_AUDIT_NO_ID,
+                           SSS_AUDIT_FAILURE);
             ret = EXIT_FAILURE;
             goto fini;
         }
@@ -149,6 +160,9 @@ int main(int argc, const char **argv)
             DEBUG(SSSDBG_CRIT_FAILURE,
                   "Cannot parse FQDN groups to add the user to\n");
             ERROR("Groups must be in the same domain as user\n");
+            SSS_AUDIT_ACCT(AUDIT_ADD_USER, "parsing group domain",
+                           tctx->octx->name, SSS_AUDIT_NO_ID,
+                           SSS_AUDIT_FAILURE);
             ret = EXIT_FAILURE;
             goto fini;
         }
@@ -157,6 +171,9 @@ int main(int argc, const char **argv)
         ret = check_group_names(tctx, tctx->octx->addgroups, &badgroup);
         if (ret != EOK) {
             ERROR("Cannot find group %1$s in local domain\n", badgroup);
+            SSS_AUDIT_ACCT(AUDIT_ADD_USER, "checking group names",
+                           tctx->octx->name, SSS_AUDIT_NO_ID,
+                           SSS_AUDIT_FAILURE);
             ret = EXIT_FAILURE;
             goto fini;
         }
@@ -172,6 +189,9 @@ int main(int argc, const char **argv)
                            pc_create_home, pc_skeldir);
     if (ret != EOK) {
         ERROR("Cannot set default values\n");
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "setting default valuse",
+                       tctx->octx->name, tctx->octx->uid, SSS_AUDIT_FAILURE);
+
         ret = EXIT_FAILURE;
         goto fini;
     }
@@ -179,6 +199,8 @@ int main(int argc, const char **argv)
     /* arguments processed, go on to actual work */
     if (id_in_range(tctx->octx->uid, tctx->octx->domain) != EOK) {
         ERROR("The selected UID is outside the allowed range\n");
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "checking if UID is in range",
+                       tctx->octx->name, tctx->octx->uid, SSS_AUDIT_FAILURE);
         ret = EXIT_FAILURE;
         goto fini;
     }
@@ -186,6 +208,9 @@ int main(int argc, const char **argv)
     tctx->error = sysdb_transaction_start(tctx->sysdb);
     if (tctx->error != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "starting sysdb transaction",
+                       tctx->octx->name, tctx->octx->uid, SSS_AUDIT_FAILURE);
+
         goto done;
     }
     in_transaction = true;
@@ -193,12 +218,16 @@ int main(int argc, const char **argv)
     /* useradd */
     tctx->error = useradd(tctx, tctx->octx);
     if (tctx->error) {
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "adding user",
+                       tctx->octx->name, tctx->octx->uid, SSS_AUDIT_FAILURE);
         goto done;
     }
 
     tctx->error = sysdb_transaction_commit(tctx->sysdb);
     if (tctx->error) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "commit transaction",
+                       tctx->octx->name, tctx->octx->uid, SSS_AUDIT_FAILURE);
         goto done;
     }
     in_transaction = false;
@@ -208,6 +237,8 @@ int main(int argc, const char **argv)
     ret = set_seuser(tctx->octx->name, pc_selinux_user);
     if (ret != EOK) {
         ERROR("Cannot set SELinux login context\n");
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "setting SELinux login context",
+                       tctx->octx->name, tctx->octx->uid, SSS_AUDIT_FAILURE);
         ret = EXIT_FAILURE;
         goto fini;
     }
@@ -221,6 +252,9 @@ int main(int argc, const char **argv)
                                       tctx->octx->name,
                                       tctx->octx);
             if (ret != EOK) {
+                SSS_AUDIT_ACCT(AUDIT_ADD_USER, "getting user info",
+                               tctx->octx->name, tctx->octx->uid,
+                               SSS_AUDIT_FAILURE);
                 ERROR("Cannot get info about the user\n");
                 ret = EXIT_FAILURE;
                 goto fini;
@@ -237,6 +271,9 @@ int main(int argc, const char **argv)
                   "data from skeldir\n");
         } else if (ret != EOK) {
             ERROR("Cannot create user's home directory: %1$s\n", strerror(ret));
+            SSS_AUDIT_ACCT(AUDIT_ADD_USER, "creating home directory",
+                           tctx->octx->name, tctx->octx->uid,
+                           SSS_AUDIT_FAILURE);
             ret = EXIT_FAILURE;
             goto fini;
         }
@@ -251,11 +288,16 @@ int main(int argc, const char **argv)
             DEBUG(SSSDBG_CRIT_FAILURE,
                   "Cannot create user's mail spool: [%d][%s].\n",
                         ret, strerror(ret));
+            SSS_AUDIT_ACCT(AUDIT_ADD_USER, "creating mail spool",
+                           tctx->octx->name, tctx->octx->uid,
+                           SSS_AUDIT_FAILURE);
             ret = EXIT_FAILURE;
             goto fini;
         }
     }
 
+    user_added = true;
+
 done:
     if (in_transaction) {
         sret = sysdb_transaction_cancel(tctx->sysdb);
@@ -285,7 +327,11 @@ done:
     }
 
     ret = EXIT_SUCCESS;
-
+    if (user_added) {
+        SSS_AUDIT_ACCT(AUDIT_ADD_USER, "adding user",
+                       tctx->octx->name, tctx->octx->uid,
+                       SSS_AUDIT_SUCCESS);
+    }
 fini:
     poptFreeContext(pc);
     talloc_free(tctx);
-- 
1.7.11.2

