You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
167 lines
6.0 KiB
167 lines
6.0 KiB
diff -up Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.c.uid-range Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.c |
|
--- Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.c.uid-range 2017-09-08 14:46:58.869496414 +0200 |
|
+++ Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.c 2017-10-09 17:42:13.947599041 +0200 |
|
@@ -198,6 +198,54 @@ cleanup_old_status (pam_handle_t *pamh, |
|
free (data); |
|
} |
|
|
|
+enum uid_range { UID_RANGE_NONE, UID_RANGE_MM, UID_RANGE_MIN, |
|
+ UID_RANGE_ONE, UID_RANGE_ERR }; |
|
+ |
|
+static enum uid_range |
|
+parse_uid_range(pam_handle_t *pamh, const char *s, |
|
+ uid_t *min_uid, uid_t *max_uid) |
|
+{ |
|
+ const char *range = s; |
|
+ const char *pmax; |
|
+ char *endptr; |
|
+ enum uid_range rv = UID_RANGE_MM; |
|
+ |
|
+ if ((pmax=strchr(range, ':')) == NULL) |
|
+ return UID_RANGE_NONE; |
|
+ ++pmax; |
|
+ |
|
+ if (range[0] == ':') |
|
+ rv = UID_RANGE_ONE; |
|
+ else { |
|
+ errno = 0; |
|
+ *min_uid = strtoul (range, &endptr, 10); |
|
+ if (errno != 0 || (range == endptr) || *endptr != ':') { |
|
+ pam_syslog(pamh, LOG_DEBUG, |
|
+ "wrong min_uid value in '%s'", s); |
|
+ return UID_RANGE_ERR; |
|
+ } |
|
+ } |
|
+ |
|
+ if (*pmax == '\0') { |
|
+ if (rv == UID_RANGE_ONE) |
|
+ return UID_RANGE_ERR; |
|
+ |
|
+ return UID_RANGE_MIN; |
|
+ } |
|
+ |
|
+ errno = 0; |
|
+ *max_uid = strtoul (pmax, &endptr, 10); |
|
+ if (errno != 0 || (pmax == endptr) || *endptr != '\0') { |
|
+ pam_syslog(pamh, LOG_DEBUG, |
|
+ "wrong max_uid value in '%s'", s); |
|
+ return UID_RANGE_ERR; |
|
+ } |
|
+ |
|
+ if (rv == UID_RANGE_ONE) |
|
+ *min_uid = *max_uid; |
|
+ return rv; |
|
+} |
|
+ |
|
int |
|
pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char **argv) |
|
{ |
|
@@ -207,6 +255,7 @@ pam_sm_open_session (pam_handle_t *pamh, |
|
struct audit_tty_status *old_status, new_status; |
|
const char *user; |
|
int i, fd, open_only; |
|
+ struct passwd *pwd; |
|
#ifdef HAVE_STRUCT_AUDIT_TTY_STATUS_LOG_PASSWD |
|
int log_passwd; |
|
#endif /* HAVE_STRUCT_AUDIT_TTY_STATUS_LOG_PASSWD */ |
|
@@ -219,6 +268,14 @@ pam_sm_open_session (pam_handle_t *pamh, |
|
return PAM_SESSION_ERR; |
|
} |
|
|
|
+ pwd = pam_modutil_getpwnam(pamh, user); |
|
+ if (pwd == NULL) |
|
+ { |
|
+ pam_syslog(pamh, LOG_WARNING, |
|
+ "open_session unknown user '%s'", user); |
|
+ return PAM_SESSION_ERR; |
|
+ } |
|
+ |
|
command = CMD_NONE; |
|
open_only = 0; |
|
#ifdef HAVE_STRUCT_AUDIT_TTY_STATUS_LOG_PASSWD |
|
@@ -236,13 +293,31 @@ pam_sm_open_session (pam_handle_t *pamh, |
|
copy = strdup (strchr (argv[i], '=') + 1); |
|
if (copy == NULL) |
|
return PAM_SESSION_ERR; |
|
- for (tok = strtok_r (copy, ",", &tok_data); tok != NULL; |
|
+ for (tok = strtok_r (copy, ",", &tok_data); |
|
+ tok != NULL && command != this_command; |
|
tok = strtok_r (NULL, ",", &tok_data)) |
|
{ |
|
- if (fnmatch (tok, user, 0) == 0) |
|
+ uid_t min_uid = 0, max_uid = 0; |
|
+ switch (parse_uid_range(pamh, tok, &min_uid, &max_uid)) |
|
{ |
|
- command = this_command; |
|
- break; |
|
+ case UID_RANGE_NONE: |
|
+ if (fnmatch (tok, user, 0) == 0) |
|
+ command = this_command; |
|
+ break; |
|
+ case UID_RANGE_MM: |
|
+ if (pwd->pw_uid >= min_uid && pwd->pw_uid <= max_uid) |
|
+ command = this_command; |
|
+ break; |
|
+ case UID_RANGE_MIN: |
|
+ if (pwd->pw_uid >= min_uid) |
|
+ command = this_command; |
|
+ break; |
|
+ case UID_RANGE_ONE: |
|
+ if (pwd->pw_uid == max_uid) |
|
+ command = this_command; |
|
+ break; |
|
+ case UID_RANGE_ERR: |
|
+ break; |
|
} |
|
} |
|
free (copy); |
|
diff -up Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.8.xml.uid-range Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.8.xml |
|
--- Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.8.xml.uid-range 2013-08-28 10:53:40.000000000 +0200 |
|
+++ Linux-PAM-1.1.8/modules/pam_tty_audit/pam_tty_audit.8.xml 2017-09-08 14:46:58.895497022 +0200 |
|
@@ -44,10 +44,10 @@ |
|
</term> |
|
<listitem> |
|
<para> |
|
- For each user matching one of comma-separated glob |
|
- <option><replaceable>patterns</replaceable></option>, disable |
|
- TTY auditing. This overrides any previous <option>enable</option> |
|
- option matching the same user name on the command line. |
|
+ For each user matching <option><replaceable>patterns</replaceable></option>, |
|
+ disable TTY auditing. This overrides any previous <option>enable</option> |
|
+ option matching the same user name on the command line. See NOTES |
|
+ for further description of <option><replaceable>patterns</replaceable></option>. |
|
</para> |
|
</listitem> |
|
</varlistentry> |
|
@@ -57,10 +57,10 @@ |
|
</term> |
|
<listitem> |
|
<para> |
|
- For each user matching one of comma-separated glob |
|
- <option><replaceable>patterns</replaceable></option>, enable |
|
- TTY auditing. This overrides any previous <option>disable</option> |
|
- option matching the same user name on the command line. |
|
+ For each user matching <option><replaceable>patterns</replaceable></option>, |
|
+ enable TTY auditing. This overrides any previous <option>disable</option> |
|
+ option matching the same user name on the command line. See NOTES |
|
+ for further description of <option><replaceable>patterns</replaceable></option>. |
|
</para> |
|
</listitem> |
|
</varlistentry> |
|
@@ -139,6 +139,16 @@ |
|
To view the data that was logged by the kernel to audit use |
|
the command <command>aureport --tty</command>. |
|
</para> |
|
+ <para> |
|
+ The <option><replaceable>patterns</replaceable></option> are comma separated |
|
+ lists of glob patterns or ranges of uids. A range is specified as |
|
+ <replaceable>min_uid</replaceable>:<replaceable>max_uid</replaceable> where |
|
+ one of these values can be empty. If <replaceable>min_uid</replaceable> is |
|
+ empty only user with the uid <replaceable>max_uid</replaceable> will be |
|
+ matched. If <replaceable>max_uid</replaceable> is empty users with the uid |
|
+ greater than or equal to <replaceable>min_uid</replaceable> will be |
|
+ matched. |
|
+ </para> |
|
</refsect1> |
|
|
|
<refsect1 id='pam_tty_audit-examples'>
|
|
|