# HG changeset patch
# Parent  809710283f937b33959f5c72feca7a3a146e299b
# Linux audit subsystem support
# based on upstream patch
# 10431:2ba4b371ab87
# - (dtucker) [LICENCE Makefile.in audit-bsm.c audit-linux.c audit.c audit.h
#   configure.ac defines.h loginrec.c]  Bug #1402: add linux audit subsystem
#   support, based on patches from Tomas Mraz and jchadima at redhat.

diff --git a/openssh-5.1p1/LICENCE b/openssh-5.1p1/LICENCE
--- a/openssh-5.1p1/LICENCE
+++ b/openssh-5.1p1/LICENCE
@@ -201,16 +201,17 @@ 6)
 	Solar Designer
 	Todd C. Miller
 	Wayne Schroeder
 	William Jones
 	Darren Tucker
 	Sun Microsystems
 	The SCO Group
 	Daniel Walsh
+	Red Hat, Inc
 
      * Redistribution and use in source and binary forms, with or without
      * modification, are permitted provided that the following conditions
      * are met:
      * 1. Redistributions of source code must retain the above copyright
      *    notice, this list of conditions and the following disclaimer.
      * 2. Redistributions in binary form must reproduce the above copyright
      *    notice, this list of conditions and the following disclaimer in the
diff --git a/openssh-5.1p1/Makefile.in b/openssh-5.1p1/Makefile.in
--- a/openssh-5.1p1/Makefile.in
+++ b/openssh-5.1p1/Makefile.in
@@ -73,26 +73,27 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \
 	kexgex.o kexdhc.o kexgexc.o scard.o msg.o progressmeter.o dns.o \
 	entropy.o scard-opensc.o gss-genr.o umac.o
 
 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
 	sshconnect.o sshconnect1.o sshconnect2.o mux.o
 
 SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
+	audit.o audit-bsm.o audit-linux.o platform.o \
 	sshpty.o sshlogin.o servconf.o serverloop.o \
 	auth.o auth1.o auth2.o auth-options.o session.o \
 	auth-chall.o auth2-chall.o groupaccess.o \
 	auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
 	auth2-none.o auth2-passwd.o auth2-pubkey.o \
 	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o \
 	auth-krb5.o \
 	auth2-gss.o gss-serv.o gss-serv-krb5.o \
 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
-	audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o
+	sftp-server.o sftp-common.o
 
 MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
 MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5
 MANTYPE		= @MANTYPE@
 
 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
 CONFIGFILES_IN=sshd_config ssh_config moduli
 
diff --git a/openssh-5.1p1/audit-bsm.c b/openssh-5.1p1/audit-bsm.c
--- a/openssh-5.1p1/audit-bsm.c
+++ b/openssh-5.1p1/audit-bsm.c
@@ -300,23 +300,23 @@ audit_connection_from(const char *host, 
 
 void
 audit_run_command(const char *command)
 {
 	/* not implemented */
 }
 
 void
-audit_session_open(const char *ttyn)
+audit_session_open(struct logininfo *li)
 {
 	/* not implemented */
 }
 
 void
-audit_session_close(const char *ttyn)
+audit_session_close(struct logininfo *li)
 {
 	/* not implemented */
 }
 
 void
 audit_event(ssh_audit_event_t event)
 {
 	char    textbuf[BSM_TEXTBUFSZ];
diff --git a/openssh-5.1p1/audit-linux.c b/openssh-5.1p1/audit-linux.c
new file mode 100644
--- /dev/null
+++ b/openssh-5.1p1/audit-linux.c
@@ -0,0 +1,126 @@
+/* $Id$ */
+
+/*
+ * Copyright 2010 Red Hat, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
+ */
+
+#include "includes.h"
+#if defined(USE_LINUX_AUDIT)
+#include <libaudit.h>
+#include <unistd.h>
+#include <string.h>
+
+#include "log.h"
+#include "audit.h"
+#include "canohost.h"
+
+const char* audit_username(void);
+
+int
+linux_audit_record_event(int uid, const char *username,
+    const char *hostname, const char *ip, const char *ttyn, int success)
+{
+	int audit_fd, rc, saved_errno;
+
+	audit_fd = audit_open();
+	if (audit_fd < 0) {
+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
+		    errno == EAFNOSUPPORT)
+			return 1; /* No audit support in kernel */
+		else
+			return 0; /* Must prevent login */
+	}
+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
+	    NULL, "login", username ? username : "(unknown)",
+	    username == NULL ? uid : -1, hostname, ip, ttyn, success);
+	saved_errno = errno;
+	close(audit_fd);
+	/*
+	 * Do not report error if the error is EPERM and sshd is run as non
+	 * root user.
+	 */
+	if ((rc == -EPERM) && (geteuid() != 0))
+		rc = 0;
+	errno = saved_errno;
+	return (rc >= 0);
+}
+
+/* Below is the sshd audit API code */
+
+void
+audit_connection_from(const char *host, int port)
+{
+}
+	/* not implemented */
+
+void
+audit_run_command(const char *command)
+{
+	/* not implemented */
+}
+
+void
+audit_session_open(struct logininfo *li)
+{
+	if (linux_audit_record_event(li->uid, NULL, li->hostname,
+	    NULL, li->line, 1) == 0)
+		fatal("linux_audit_write_entry failed: %s", strerror(errno));
+}
+
+void
+audit_session_close(struct logininfo *li)
+{
+	/* not implemented */
+}
+
+void
+audit_event(ssh_audit_event_t event)
+{
+	switch(event) {
+	case SSH_AUTH_SUCCESS:
+	case SSH_CONNECTION_CLOSE:
+	case SSH_NOLOGIN:
+	case SSH_LOGIN_EXCEED_MAXTRIES:
+	case SSH_LOGIN_ROOT_DENIED:
+		break;
+
+	case SSH_AUTH_FAIL_NONE:
+	case SSH_AUTH_FAIL_PASSWD:
+	case SSH_AUTH_FAIL_KBDINT:
+	case SSH_AUTH_FAIL_PUBKEY:
+	case SSH_AUTH_FAIL_HOSTBASED:
+	case SSH_AUTH_FAIL_GSSAPI:
+	case SSH_INVALID_USER:
+		linux_audit_record_event(-1, audit_username(), NULL,
+			get_remote_ipaddr(), "sshd", 0);
+		break;
+
+	default:
+		debug("%s: unhandled event %d", __func__, event);
+	}
+}
+
+#endif /* USE_LINUX_AUDIT */
diff --git a/openssh-5.1p1/audit.c b/openssh-5.1p1/audit.c
--- a/openssh-5.1p1/audit.c
+++ b/openssh-5.1p1/audit.c
@@ -142,35 +142,35 @@ audit_event(ssh_audit_event_t event)
 /*
  * Called when a user session is started.  Argument is the tty allocated to
  * the session, or NULL if no tty was allocated.
  *
  * Note that this may be called multiple times if multiple sessions are used
  * within a single connection.
  */
 void
-audit_session_open(const char *ttyn)
+audit_session_open(struct logininfo *li)
 {
-	const char *t = ttyn ? ttyn : "(no tty)";
+	const char *t = li->line ? li->line : "(no tty)";
 
 	debug("audit session open euid %d user %s tty name %s", geteuid(),
 	    audit_username(), t);
 }
 
 /*
  * Called when a user session is closed.  Argument is the tty allocated to
  * the session, or NULL if no tty was allocated.
  *
  * Note that this may be called multiple times if multiple sessions are used
  * within a single connection.
  */
 void
-audit_session_close(const char *ttyn)
+audit_session_close(struct logininfo *li)
 {
-	const char *t = ttyn ? ttyn : "(no tty)";
+	const char *t = li->line ? li->line : "(no tty)";
 
 	debug("audit session close euid %d user %s tty name %s", geteuid(),
 	    audit_username(), t);
 }
 
 /*
  * This will be called when a user runs a non-interactive command.  Note that
  * it may be called multiple times for a single connection since SSH2 allows
diff --git a/openssh-5.1p1/audit.h b/openssh-5.1p1/audit.h
--- a/openssh-5.1p1/audit.h
+++ b/openssh-5.1p1/audit.h
@@ -21,16 +21,19 @@
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef _SSH_AUDIT_H
 # define _SSH_AUDIT_H
+
+#include "loginrec.h"
+
 enum ssh_audit_event_type {
 	SSH_LOGIN_EXCEED_MAXTRIES,
 	SSH_LOGIN_ROOT_DENIED,
 	SSH_AUTH_SUCCESS,
 	SSH_AUTH_FAIL_NONE,
 	SSH_AUTH_FAIL_PASSWD,
 	SSH_AUTH_FAIL_KBDINT,	/* keyboard-interactive or challenge-response */
 	SSH_AUTH_FAIL_PUBKEY,	/* ssh2 pubkey or ssh1 rsa */
@@ -41,14 +44,14 @@ enum ssh_audit_event_type {
 	SSH_CONNECTION_CLOSE,	/* closed after attempting auth or session */
 	SSH_CONNECTION_ABANDON,	/* closed without completing auth */
 	SSH_AUDIT_UNKNOWN
 };
 typedef enum ssh_audit_event_type ssh_audit_event_t;
 
 void	audit_connection_from(const char *, int);
 void	audit_event(ssh_audit_event_t);
-void	audit_session_open(const char *);
-void	audit_session_close(const char *);
+void	audit_session_open(struct logininfo *);
+void	audit_session_close(struct logininfo *);
 void	audit_run_command(const char *);
 ssh_audit_event_t audit_classify_auth(const char *);
 
 #endif /* _SSH_AUDIT_H */
diff --git a/openssh-5.1p1/configure.ac b/openssh-5.1p1/configure.ac
--- a/openssh-5.1p1/configure.ac
+++ b/openssh-5.1p1/configure.ac
@@ -1257,17 +1257,17 @@ int main(void)
 		    [ AC_MSG_RESULT(no)
 		      AC_MSG_ERROR(libedit version is not compatible) ]
 		)
 	fi ]
 )
 
 AUDIT_MODULE=none
 AC_ARG_WITH(audit,
-	[  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
+	[  --with-audit=module     Enable audit support (modules=debug,bsm,linux)],
 	[
 	  AC_MSG_CHECKING(for supported audit module)
 	  case "$withval" in
 	  bsm)
 		AC_MSG_RESULT(bsm)
 		AUDIT_MODULE=bsm
 		dnl    Checks for headers, libs and functions
 		AC_CHECK_HEADERS(bsm/audit.h, [],
@@ -1281,20 +1281,28 @@ AC_ARG_WITH(audit,
 		AC_CHECK_LIB(bsm, getaudit, [],
 		    [AC_MSG_ERROR(BSM enabled and required library not found)])
 		AC_CHECK_FUNCS(getaudit, [],
 		    [AC_MSG_ERROR(BSM enabled and required function not found)])
 		# These are optional
 		AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
 		AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
 		;;
+	  linux)
+		AC_MSG_RESULT(linux)
+		AUDIT_MODULE=linux
+		dnl    Checks for headers, libs and functions
+		AC_CHECK_HEADERS(libaudit.h)
+		SSHDLIBS="$SSHDLIBS -laudit"
+		AC_DEFINE(USE_LINUX_AUDIT, 1, [Use Linux audit module])
+		;;
 	  debug)
 		AUDIT_MODULE=debug
 		AC_MSG_RESULT(debug)
-		AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
+		AC_DEFINE(SSH_AUDIT_EVENTS, 1, [Use audit debugging module])
 		;;
 	  no)
 		AC_MSG_RESULT(no)
 		;;
 	  *)
 		AC_MSG_ERROR([Unknown audit module $withval])
 		;;
 	esac ]
diff --git a/openssh-5.1p1/defines.h b/openssh-5.1p1/defines.h
--- a/openssh-5.1p1/defines.h
+++ b/openssh-5.1p1/defines.h
@@ -558,16 +558,21 @@ struct winsize {
 # define getpgrp() getpgrp(0)
 #endif
 
 #ifdef USE_BSM_AUDIT
 # define SSH_AUDIT_EVENTS
 # define CUSTOM_SSH_AUDIT_EVENTS
 #endif
 
+#ifdef USE_LINUX_AUDIT
+# define SSH_AUDIT_EVENTS
+# define CUSTOM_SSH_AUDIT_EVENTS
+#endif
+
 #if !defined(HAVE___func__) && defined(HAVE___FUNCTION__)
 #  define __func__ __FUNCTION__
 #elif !defined(HAVE___func__)
 #  define __func__ ""
 #endif
 
 #if defined(KRB5) && !defined(HEIMDAL)
 #  define krb5_get_err_text(context,code) error_message(code)
diff --git a/openssh-5.1p1/loginrec.c b/openssh-5.1p1/loginrec.c
--- a/openssh-5.1p1/loginrec.c
+++ b/openssh-5.1p1/loginrec.c
@@ -473,19 +473,19 @@ login_write(struct logininfo *li)
 #ifdef CUSTOM_SYS_AUTH_RECORD_LOGIN
 	if (li->type == LTYPE_LOGIN &&
 	    !sys_auth_record_login(li->username,li->hostname,li->line,
 	    &loginmsg))
 		logit("Writing login record failed for %s", li->username);
 #endif
 #ifdef SSH_AUDIT_EVENTS
 	if (li->type == LTYPE_LOGIN)
-		audit_session_open(li->line);
+		audit_session_open(li);
 	else if (li->type == LTYPE_LOGOUT)
-		audit_session_close(li->line);
+		audit_session_close(li);
 #endif
 	return (0);
 }
 
 #ifdef LOGIN_NEEDS_UTMPX
 int
 login_utmp_only(struct logininfo *li)
 {
