mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-06 23:43:20 +02:00
71 lines
2.6 KiB
Diff
71 lines
2.6 KiB
Diff
From 0ff2b7562154289de39abb10bcec2bc0d744a64d Mon Sep 17 00:00:00 2001
|
|
From: Joachim Wiberg <troglobit@gmail.com>
|
|
Date: Wed, 21 Aug 2024 16:04:43 +0200
|
|
Subject: [PATCH 6/7] Add audit trail for high priority system changes
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
Organization: Wires
|
|
|
|
Committing a change to running, copying to a datastore, or calling an
|
|
RPC may be restricted by NACM. In these cases a system administrator
|
|
may want to know who made a change or sent an RPC.
|
|
|
|
For commit, we are only interested in changes to the running ds, which
|
|
is when the system actually activates the changes. Copying to startup
|
|
or other datastores is handled separately.
|
|
|
|
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
|
|
Signed-off-by: Mattias Walström <lazzer@gmail.com>
|
|
---
|
|
src/sysrepo.c | 12 ++++++++++++
|
|
1 file changed, 12 insertions(+)
|
|
|
|
diff --git a/src/sysrepo.c b/src/sysrepo.c
|
|
index ca2026b2..2ea546e9 100644
|
|
--- a/src/sysrepo.c
|
|
+++ b/src/sysrepo.c
|
|
@@ -4518,6 +4518,9 @@ store:
|
|
goto cleanup;
|
|
}
|
|
|
|
+ if (session && session->nacm_user && mod_info->ds == SR_DS_RUNNING)
|
|
+ SR_LOG_SEC("user \"%s\" commiting changes to %s ...", session->nacm_user, sr_ds2str(mod_info->ds));
|
|
+
|
|
/* publish "done" event, all changes were applied */
|
|
if ((err_info = sr_shmsub_change_notify_change_done(mod_info, orig_name, orig_data, timeout_ms, &cb_err_info))) {
|
|
goto cleanup;
|
|
@@ -4529,6 +4532,9 @@ store:
|
|
}
|
|
|
|
cleanup:
|
|
+ if (session && session->nacm_user && mod_info->ds == SR_DS_RUNNING)
|
|
+ SR_LOG_SEC("user \"%s\" committed changes to %s.", session->nacm_user, sr_ds2str(mod_info->ds));
|
|
+
|
|
if (change_sub_lock && !has_change_sub_lock) {
|
|
assert(change_sub_lock == SR_LOCK_READ);
|
|
|
|
@@ -5031,6 +5037,9 @@ sr_copy_config(sr_session_ctx_t *session, const char *module_name, sr_datastore_
|
|
}
|
|
}
|
|
|
|
+ if (session->nacm_user && src_datastore != SR_DS_CANDIDATE)
|
|
+ SR_LOG_SEC("user \"%s\" copied %s to %s", session->nacm_user, sr_ds2str(src_datastore), sr_ds2str(session->ds));
|
|
+
|
|
cleanup:
|
|
/* MODULES UNLOCK */
|
|
sr_shmmod_modinfo_unlock(&mod_info);
|
|
@@ -7562,6 +7571,9 @@ sr_rpc_send_tree(sr_session_ctx_t *session, struct lyd_node *input, uint32_t tim
|
|
}
|
|
}
|
|
|
|
+ if (session->nacm_user && path)
|
|
+ SR_LOG_SEC("user \"%s\" called RPC %s", session->nacm_user, path);
|
|
+
|
|
if (LYD_CTX(input_top) != LYD_CTX(input_op)) {
|
|
/* different contexts if these are data of an extension (schema-mount) */
|
|
for (ext_parent = input_op; ext_parent && !(ext_parent->flags & LYD_EXT); ext_parent = lyd_parent(ext_parent)) {}
|
|
--
|
|
2.43.0
|
|
|