base/SOURCES/netkit-rsh-0.17-audit.patch

diff -up netkit-rsh-0.17/rshd/Makefile.audit netkit-rsh-0.17/rshd/Makefile
--- netkit-rsh-0.17/rshd/Makefile.audit	2008-03-25 12:33:26.000000000 +0100
+++ netkit-rsh-0.17/rshd/Makefile	2008-03-25 12:33:26.000000000 +0100
@@ -9,6 +9,10 @@ ifeq ($(USE_PAM),1)
 CFLAGS += -DUSE_PAM
 LIBS += -ldl -lpam -lpam_misc
 endif
+ifeq ($(USE_AUDIT),1)
+CFLAGS += -DUSE_AUDIT
+LIBS += -ldl -laudit
+endif
 
 rshd: $(OBJS)
 	$(CC) $(LDFLAGS) $^ $(LIBS) -o $@
diff -up netkit-rsh-0.17/rshd/rshd.c.audit netkit-rsh-0.17/rshd/rshd.c
--- netkit-rsh-0.17/rshd/rshd.c.audit	2008-03-25 12:33:26.000000000 +0100
+++ netkit-rsh-0.17/rshd/rshd.c	2008-03-25 12:35:37.000000000 +0100
@@ -90,6 +90,10 @@ char rcsid[] = 
 static pam_handle_t *pamh;
 #endif /* USE_PAM */
 
+#ifdef USE_AUDIT
+#include <libaudit.h>
+#endif /* USE_AUDIT */
+
 #define	OPTIONS	"aDhlLn"
 
 static int keepalive = 1;
@@ -224,6 +228,14 @@ static void stderr_parent(int sock, int 
     exit(0);
 }
 
+#define PAM_SET_ITEM(item,val) \
+    do { \
+	retcode = pam_set_item(pamh, (item), (val)); \
+	if (retcode != PAM_SUCCESS) { \
+	    syslog(LOG_ERR, "pam_set_item: %s\n", pam_strerror(pamh, retcode)); \
+	    exit (1); \
+	} \
+    } while (0)
 
 static struct passwd *doauth(const char *remuser, 
 			     const char *hostname, 
@@ -243,9 +255,10 @@ static struct passwd *doauth(const char 
 	syslog(LOG_ERR, "pam_start: %s\n", pam_strerror(pamh, retcode));
 	exit (1);
     }
-    pam_set_item (pamh, PAM_RUSER, remuser);
-    pam_set_item (pamh, PAM_RHOST, hostname);
-    pam_set_item (pamh, PAM_TTY, "rsh");  /* we don't use a tty, so punt */
+
+    PAM_SET_ITEM(PAM_RUSER, remuser);
+    PAM_SET_ITEM(PAM_RHOST, hostname);
+    PAM_SET_ITEM(PAM_TTY, "rsh");  /* we don't use a tty, so punt */
     
     retcode = pam_authenticate(pamh, 0);
     if (retcode == PAM_SUCCESS) {
@@ -365,6 +378,27 @@ static const char *findhostname(struct s
 	return NULL; /* not reachable */
 }
 
+static int log_audit(const char *username, int uid, const char *hostname,
+			int success)
+{
+#ifdef USE_AUDIT
+	int audit_fd = audit_open();
+	if (audit_fd < 0) {
+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&
+					errno != EAFNOSUPPORT) 
+			return 1;
+	} else {
+		int rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
+				NULL, "login", username, uid, hostname, NULL,
+				"rsh", success);
+		close(audit_fd);
+		if (rc <= 0) 
+			return 1;
+	}
+#endif
+	return 0;
+}
+
 static void
 doit(struct sockaddr_storage *fromp, socklen_t fromlen)
 {
@@ -435,14 +469,21 @@ doit(struct sockaddr_storage *fromp, soc
 	setpwent();
 	pwd = doauth(remuser, hostname, locuser);
 	if (pwd == NULL) {
+		if (log_audit(remuser, -1, hostname, 0) > 0) {
+			fail("Error sending audit event.\n", 
+			     remuser, hostname, locuser, cmdbuf);
+		}
 		fail("Permission denied.\n", 
 		     remuser, hostname, locuser, cmdbuf);
 	}
-
 	if (pwd->pw_uid != 0 && !access(_PATH_NOLOGIN, F_OK)) {
 		error("Logins currently disabled.\n");
 		exit(1);
 	}
+	if (log_audit(NULL, pwd->pw_uid, hostname, 1) > 0) {
+		fail("Error sending audit event.\n", 
+		     remuser, hostname, locuser, cmdbuf);
+	}
 
 	(void) write(2, "\0", 1);
 	sent_null = 1;
diff -up netkit-rsh-0.17/rexecd/rexecd.c.audit netkit-rsh-0.17/rexecd/rexecd.c
--- netkit-rsh-0.17/rexecd/rexecd.c.audit	2008-03-25 12:33:26.000000000 +0100
+++ netkit-rsh-0.17/rexecd/rexecd.c	2008-03-25 12:33:26.000000000 +0100
@@ -312,9 +312,12 @@ doit(struct sockaddr_in *fromp)
        PAM_password = pass;
        pam_error = pam_start("rexec", PAM_username, &PAM_conversation,&pamh);
        PAM_BAIL;
-       pam_set_item (pamh, PAM_RUSER, user);
-       pam_set_item (pamh, PAM_RHOST, remote);	       
-       pam_set_item (pamh, PAM_TTY, "rexec");   /* we don't have a tty yet! */
+       pam_error = pam_set_item (pamh, PAM_RUSER, user);
+       PAM_BAIL;
+       pam_error = pam_set_item (pamh, PAM_RHOST, remote);	       
+       PAM_BAIL;
+       pam_error = pam_set_item (pamh, PAM_TTY, "rexec");   /* we don't have a tty yet! */
+       PAM_BAIL;
        pam_error = pam_authenticate(pamh, 0);
        PAM_BAIL;
        pam_error = pam_acct_mgmt(pamh, 0);
diff -up netkit-rsh-0.17/rlogind/auth.c.audit netkit-rsh-0.17/rlogind/auth.c
--- netkit-rsh-0.17/rlogind/auth.c.audit	2008-03-25 12:33:26.000000000 +0100
+++ netkit-rsh-0.17/rlogind/auth.c	2008-03-25 12:33:26.000000000 +0100
@@ -102,6 +102,16 @@ static int attempt_auth(void) {
     return retval;
 }
 
+#define PAM_SET_ITEM(item,val) \
+    do { \
+	retval = pam_set_item(pamh, (item), (val)); \
+	if (retval != PAM_SUCCESS) { \
+	    syslog(LOG_ERR, "pam_set_item: %s\n", pam_strerror(pamh, retval)); \
+	    pam_end(pamh, retval); \
+	    fatal(STDERR_FILENO, "initialization failed", 0); \
+	} \
+    } while (0)
+
 /*
  * This function must either die, return -1 on authentication failure,
  * or return 0 on authentication success. Dying is discouraged.
@@ -117,17 +127,19 @@ int auth_checkauth(const char *remoteuse
     retval = pam_start("rlogin", localuser, &conv, &pamh);
     if (retval != PAM_SUCCESS) {
 	syslog(LOG_ERR, "pam_start: %s\n", pam_strerror(pamh, retval));
+        pam_end(pamh, retval);
 	fatal(STDERR_FILENO, "initialization failed", 0);
     }
 	
-    pam_set_item(pamh, PAM_USER, localuser);
-    pam_set_item(pamh, PAM_RUSER, remoteuser);
-    pam_set_item(pamh, PAM_RHOST, host);
-    pam_set_item(pamh, PAM_TTY, "rlogin");   /* we don't have a tty yet! */
-	
+    PAM_SET_ITEM(PAM_USER, localuser);
+    PAM_SET_ITEM(PAM_RUSER, remoteuser);
+    PAM_SET_ITEM(PAM_RHOST, host);
+    PAM_SET_ITEM(PAM_TTY, "rlogin");   /* we don't have a tty yet! */
+
     network_confirm();
     retval = attempt_auth();
     if ((retval == PAM_ACCT_EXPIRED) || (retval == PAM_PERM_DENIED)) {
+	pam_end(pamh, retval);
 	syslog(LOG_ERR, "PAM authentication denied for in.rlogind");
 	exit(1);
     } else if (retval != PAM_SUCCESS) {
diff -up netkit-rsh-0.17/rlogind/rlogind.c.audit netkit-rsh-0.17/rlogind/rlogind.c
--- netkit-rsh-0.17/rlogind/rlogind.c.audit	2008-03-25 12:33:26.000000000 +0100
+++ netkit-rsh-0.17/rlogind/rlogind.c	2008-03-25 12:33:26.000000000 +0100
@@ -357,9 +357,9 @@ static void child(const char *hname, con
     }
     termenv[3] = NULL;
 
+    auth_finish();
+    closeall();
     if (authenticated) {
-	auth_finish();
-	closeall();
 	execle(_PATH_LOGIN, "login", "-p",
 	       "-h", hname, "-f", localuser, NULL, termenv);
     } 
@@ -368,8 +368,6 @@ static void child(const char *hname, con
 	    syslog(LOG_AUTH|LOG_INFO, "rlogin with an option as a name!");
 	    exit(1);
 	}
-	auth_finish();
-	closeall();
 	execle(_PATH_LOGIN, "login", "-p",
 	       "-h", hname, localuser, NULL, termenv);
     }
diff -up netkit-rsh-0.17/configure.audit netkit-rsh-0.17/configure
--- netkit-rsh-0.17/configure.audit	2000-07-29 20:00:29.000000000 +0200
+++ netkit-rsh-0.17/configure	2008-03-25 12:33:26.000000000 +0100
@@ -19,8 +19,9 @@ while [ x$1 != x ]; do case $1 in
 Usage: configure [options]
     --help                Show this message
     --with-debug          Enable debugging
-    --without-pam      Disable PAM support
+    --without-pam         Disable PAM support
     --without-shadow      Disable shadow password support
+    --without-audit       Disable audit support
     --prefix=path         Prefix for location of files [/usr]
     --exec-prefix=path    Location for arch-depedent files [prefix]
     --installroot=root    Top of filesystem tree to install in [/]
@@ -47,6 +48,7 @@ EOF
 	--with-c-compiler=*) CC=`echo $1 | sed 's/^[^=]*=//'` ;;
 	--without-pam|--disable-pam) WITHOUT_PAM=1;;
 	--without-shadow|--disable-shadow) WITHOUT_SHADOW=1;;
+	--without-audit|--disable-audit) WITHOUT_AUDIT=1;;
 	*) echo "Unrecognized option: $1"; exit 1;;
 esac 
 shift
@@ -342,6 +344,32 @@ rm -f __conftest*
 
 ##################################################
 
+echo -n 'Checking for AUDIT... '
+if [ x$WITHOUT_AUDIT != x ]; then
+    echo disabled
+else
+cat <<EOF >__conftest.c
+#include <stdio.h>
+#include <libaudit.h>
+int main() {
+    audit_log_acct_message(1, AUDIT_USER_LOGIN, NULL, NULL, NULL, 0, NULL, NULL, NULL, 0);
+    return 0;
+}
+
+EOF
+if (
+      $CC $CFLAGS  __conftest.c -laudit -o __conftest || exit 1
+   ) >/dev/null 2>&1; then
+        echo 'yes'
+        USE_AUDIT=1
+    else
+        echo 'no'
+    fi
+fi
+rm -f __conftest*
+
+##################################################
+
 echo -n 'Checking for crypt... '
 cat <<EOF >__conftest.c
 int main() { crypt("aa", "bb"); }
@@ -593,5 +621,6 @@ echo 'Generating MCONFIG...'
     echo "USE_PAM=$USE_PAM"
     echo "USE_SHADOW=$USE_SHADOW"
     echo "LIBSHADOW=$LIBSHADOW"
+    echo "USE_AUDIT=$USE_AUDIT"
 ) > MCONFIG