peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-08-06 15:43:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

confd: fix audit logs using proper facility

Browse Source 
The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see
https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for
details.  This caused all audit log messages to be logged in LOG_USER.

Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT()
to match RFC5424 terminology.

Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING.
Additionally, drop the leading [severity] prefix to sysrepo logs.  Only
needed when logging to stdout.

Follow-up to issue #521

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2024-08-30 15:29:11 +02:00
parent 7d95da7657
commit 8a09b3e22c
5 changed files with 77 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/confd/src/ietf-system.c
+27 -27
View File
@@ -607,9 +607,9 @@ static void add_group(const char *user, const char *group)
return; /* already group member */
if (systemf("adduser %s %s", user, group))
SECURITY("Failed giving user %s UNIX %s permissions.", user, group);
AUDIT("Failed giving user \"%s\" UNIX %s permissions.", user, group);
else
SECURITY("User %s added to UNIX %s group.", user, group);
AUDIT("User \"%s\" added to UNIX \"%s\" group.", user, group);
}
static void del_group(const char *user, const char *group)
@@ -620,9 +620,9 @@ static void del_group(const char *user, const char *group)
return; /* not member of group */
if (systemf("delgroup %s %s", user, group))
SECURITY("Failed removing user %s from UNIX %s group.", user, group);
AUDIT("Failed removing user \"%s\" from UNIX \"%s\" group.", user, group);
else
SECURITY("User %s removed from UNIX %s group.", user, group);
AUDIT("User \"%s\" removed from UNIX \"%s\" group.", user, group);
}
/* Users with a valid shell are also allowed CLI access */
@@ -786,7 +786,7 @@ static int sys_call_adduser(sr_session_ctx_t *sess, char *name, uid_t uid, gid_t
char **args;
int err;
DEBUG("Adding new user %s, cleaning up any stale group.", name);
DEBUG("Adding new user \"%s\", cleaning up any stale group.", name);
systemf("delgroup %s 2>/dev/null", name);
/* reusing existing uid:gid from $HOME */
@@ -840,15 +840,15 @@ static int sys_add_user(sr_session_ctx_t *sess, char *name)
/* Verify IDs aren't already used, like BusyBox adduser */
if (getpwuid(st.st_uid) || getgrgid(st.st_uid) || getgrgid(st.st_gid)) {
/* Exists but owned by someone else. */
SECURITY("Failed mapping user %s to /home/%s, uid:gid (%d:%d) already exists.",
AUDIT("Failed mapping user \"%s\" to /home/%s, uid:gid (%d:%d) already exists.",
name, name, st.st_uid, st.st_gid);
err = sys_call_adduser(sess, name, 0, 0);
} else {
SECURITY("Reusing uid:gid %d:%d and /home/%s for new user %s",
AUDIT("Reusing uid:gid %d:%d and /home/%s for new user \"%s\"",
st.st_uid, st.st_gid, name, name);
err = sys_call_adduser(sess, name, st.st_uid, st.st_gid);
if (err) {
SECURITY("Failed reusing uid:gid from /home/%s, retrying create user ...", name);
AUDIT("Failed reusing uid:gid from /home/%s, retrying create user ...", name);
err = sys_call_adduser(sess, name, 0, 0);
} else
reused = true;
@@ -857,11 +857,11 @@ static int sys_add_user(sr_session_ctx_t *sess, char *name)
err = sys_call_adduser(sess, name, 0, 0);
if (err) {
SECURITY("Failed creating new user \"%s\"", name);
AUDIT("Failed creating new user \"%s\"", name);
return SR_ERR_SYS;
}
SECURITY("User \"%s\" created%s.", name, reused ? ", mapped to existing home directory" : "");
AUDIT("User \"%s\" created%s.", name, reused ? ", mapped to existing home directory" : "");
/*
* OpenSSH in Infix has been set up to use /var/run/sshd/%s.keys
@@ -930,7 +930,7 @@ static int set_shell(const char *user, const char *shell)
if (!strcmp(pw->pw_name, user)) {
if (strcmp(pw->pw_shell, shell))
NOTE("Updating login shell for user %s to %s", user, shell);
AUDIT("Updating login shell for user \"%s\" to %s", user, shell);
upw = *pw;
upw.pw_shell = (char *)shell;
@@ -953,7 +953,7 @@ fail:
if (fp)
fclose(fp);
endpwent();
ERRNO("Failed setting user %s shell %s", user, shell);
ERRNO("Failed setting user \"%s\" shell %s", user, shell);
return -1;
}
@@ -971,7 +971,7 @@ static int set_password(const char *user, const char *hash, bool lock)
fp = fopen(_PATH_SHADOW "+", "w");
if (!fp) {
ERRNO("Failed opening %s+ for %s", _PATH_SHADOW, user);
ERRNO("Failed opening %s+ for user \"%s\"", _PATH_SHADOW, user);
goto fail;
}
fd = fileno(fp);
@@ -1016,7 +1016,7 @@ fail:
endspent();
ulckpwdf();
exit:
SECURITY("Failed setting password for %s", user);
AUDIT("Failed setting password for user \"%s\"", user);
return -1;
}
@@ -1045,7 +1045,7 @@ static const char *is_valid_hash(struct confd *confd, const char *user, const ch
pwd = json_object_get(confd->root, "factory-password-hash");
if (!json_is_string(pwd)) {
EMERG("Cannot find factory-default password hash for user %s!", user);
EMERG("Cannot find factory-default password hash for user \"%s\"!", user);
return NULL;
}
@@ -1072,7 +1072,7 @@ static sr_error_t handle_sr_passwd_update(sr_session_ctx_t *, struct confd *conf
assert(change->new);
if (change->new->type != SR_STRING_T) {
SECURITY("Internal error, expected user %s password to be string type.", user);
AUDIT("Internal error, expected user \"%s\" password to be string type.", user);
err = SR_ERR_INTERNAL;
break;
}
@@ -1090,17 +1090,17 @@ static sr_error_t handle_sr_passwd_update(sr_session_ctx_t *, struct confd *conf
if (set_password(user, hash, lock))
err = SR_ERR_SYS;
else if (lock)
NOTE("User account %s locked.", user);
NOTE("User account \"%s\" locked.", user);
else if (!strcmp(hash, "*"))
NOTE("Password login disabled for user %s", user);
NOTE("Password login disabled for user \"%s\"", user);
else
SECURITY("Password updated for user %s", user);
AUDIT("Password updated for user \"%s\"", user);
break;
case SR_OP_DELETED:
if (set_password(user, "*", false))
err = SR_ERR_SYS;
else
NOTE("Password login disabled for user %s", user);
NOTE("Password login disabled for user \"%s\"", user);
break;
case SR_OP_MOVED:
break;
@@ -1125,10 +1125,10 @@ static sr_error_t handle_sr_shell_update(sr_session_ctx_t *sess, struct confd *c
shell = sys_find_usable_shell(sess, (char *)user, is_admin_user(sess, user));
if (set_shell(user, shell)) {
SECURITY("Failed updating shell to %s for user %s", shell, user);
AUDIT("Failed updating shell to %s for user \"%s\"", shell, user);
err = SR_ERR_SYS;
} else {
SECURITY("Login shell updated for user %s", user);
AUDIT("Login shell updated for user \"%s\"", user);
err = SR_ERR_OK;
}
free(shell);
@@ -1148,7 +1148,7 @@ static sr_error_t check_sr_user_update(sr_session_ctx_t *, struct confd *, struc
name = sr_xpath_key_value(val->xpath, "user", "name", &state);
if (!is_valid_username(name)) {
SECURITY("Invalid username \"%s\"", name);
AUDIT("Invalid username \"%s\"", name);
return SR_ERR_VALIDATION_FAILED;
}
NOTE("Username \"%s\" is valid", name);
@@ -1232,7 +1232,7 @@ static sr_error_t generate_auth_keys(sr_session_ctx_t *session, const char *xpat
fp = fopenf("w", "/var/run/sshd/%s.keys", username);
if (!fp) {
ERROR("failed opening %s authorized_keys file: %s", username, strerror(errno));
ERROR("failed opening user \"%s\" authorized_keys file: %s", username, strerror(errno));
continue;
}
@@ -1361,7 +1361,7 @@ static sr_error_t change_auth_done(struct confd *confd, sr_session_ctx_t *sessio
err = generate_auth_keys(session, XPATH_AUTH_"/user//.");
if (err) {
SECURITY("failed saving authorized-key data.");
AUDIT("failed saving authorized-key data.");
goto cleanup;
}
@@ -1432,11 +1432,11 @@ static int change_nacm(sr_session_ctx_t *session, uint32_t sub_id, const char *m
for (size_t i = 0; i < user_count; i++) {
const char *user = users[i].data.string_val;
bool is_admin = is_admin_user(session, user);
char *shell;
const char *shell;
shell = sys_find_usable_shell(session, (char *)user, is_admin);
if (set_shell(user, shell))
SECURITY("Failed adjusting shell for user %s", user);
AUDIT("Failed adjusting shell for user \"%s\"", user);
if (is_admin)
add_group(user, "wheel");
src/libsrx/src/common.h
+3 -3
View File
@@ -11,8 +11,8 @@
extern int debug;
/* In IETF referred to LOG_AUDIT */
#ifndef LOG_SECURITY
#define LOG_SECURITY (1 << 13)
#ifndef LOG_AUDIT
#define LOG_AUDIT (13<<3) /* Log audit, for audit trails */
#endif
#ifndef HAVE_VASPRINTF
@@ -33,6 +33,6 @@ int asprintf(char **strp, const char *fmt, ...);
#define EMERG(fmt, ...) syslog(LOG_EMERG, fmt, ##__VA_ARGS__)
#define ERROR(fmt, ...) syslog(LOG_ERR, fmt, ##__VA_ARGS__)
#define ERRNO(fmt, ...) syslog(LOG_ERR, fmt ": %s", ##__VA_ARGS__, strerror(errno))
#define SECURITY(fmt, ...) syslog(LOG_SECURITY | LOG_NOTICE, fmt, ##__VA_ARGS__)
#define AUDIT(fmt, ...) syslog(LOG_AUDIT | LOG_NOTICE, fmt, ##__VA_ARGS__)
#endif /* CONFD_COMMON_H_ */