Re: audit

On Mon, 5 Sep 2005, Peter Vrabec wrote:
[..]

I'm look again and agin on auditing chages and I discover some IMO 
strange things in this changes. I'm just starting reding 
documetation for auditing support so please correct me if I'm wrong.

[src]$ grep AUDIT_ *c | awk '{ print $3}' | sort | uniq -c
     129 (AUDIT_USER_CHAUTHTOK,

Hmm .. *all places* wehre logging auditing records are injected are 
reported as AUDIT_USER_CHAUTHTOK .. even from error handling (?!?). Is it 
realy correct ?

First from edge .. chage.c:

         if (!amroot && !lflg) {
                 fprintf (stderr, _("%s: Permission denied.\n"), Prog);
#ifdef WITH_AUDIT
                 audit_logger (AUDIT_USER_CHAUTHTOK, Prog, "change age", NULL,
                               getuid (), 0);
#endif
                 exit (E_NOPERM);
         }

In this place auditing comment is "change age" like on case changing user 
account age but it is *error* report *not* performing this chage.
Many other places where was injected audit_logger() are very simillar.

>From libadit.h:

#define AUDIT_USER_AUTH         1100    /* User space authentication */
#define AUDIT_USER_ACCT         1101    /* User space acct change */
#define AUDIT_USER_MGMT         1102    /* User space acct management */
#define AUDIT_CRED_ACQ          1103    /* User space credential acquired */
#define AUDIT_CRED_DISP         1104    /* User space credential disposed */
#define AUDIT_USER_START        1105    /* User space session start */
#define AUDIT_USER_END          1106    /* User space session end */
#define AUDIT_USER_AVC          1107    /* User space avc message */
#define AUDIT_USER_CHAUTHTOK    1108    /* User space acct attr changed */
#define AUDIT_USER_ERR          1109    /* User space acct state err */
#define AUDIT_CRED_REFR         1110    /* User space credential refreshed */
#define AUDIT_USYS_CONFIG       1111    /* User space system config change */

On first look on this list loging all auditing records as
AUDIT_USER_CHAUTHTOK is incorrect.
Probaly using "usedadd -D <other_options>" will be good report as 
AUDIT_USYS_CONFIG (?). Succesfull changing account propertiees as 
AUDIT_USER_ACCT (what about changing group properties ?).
Probaly start/stop su, login, newgrp session will be good mark as 
AUDIT_USER_START/AUDIT_USER_END (?).

Questions like above after spending more time will be probably much more.

Looks like will be better mark in NEWS file add auditing support as 
completly experimental and not finished.

kloczek
-- 
-----------------------------------------------------------
*Ludzie nie majÂą problemĂłw, tylko sobie sami je stwarzajÂą*
-----------------------------------------------------------
Tomasz KÂłoczko, sys adm @zie.pg.gda.pl|*e-mail: [email protected]*