Merge lp:~tyhicks/lightdm/auditing into lp:lightdm

[Tyler Hicks]

Adds the ability to generate audit log events when a user is logging in or out.

I've tested logging in and out as an admin user w/ password, a standard user w/ password, an autologin user, and a guest session. Unfortunately, I don't know how to test remote sessions.

[Seth Arnold (seth-arnold)]

Is it kosher to modify configure.ac directly?

Thanks

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:2181
No commit message was specified in the merge proposal. Click on the following link and set the commit message (if you want a jenkins rebuild you need to trigger it yourself):
https://code.launchpad.net/~tyhicks/lightdm/auditing/+merge/269828/+edit-commit-message

http://jenkins.qa.ubuntu.com/job/lightdm-ci/312/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-wily-amd64-ci/2
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-wily-armhf-ci/2

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/lightdm-ci/312/rebuild

review: Needs Fixing (continuous-integration)

[Tyler Hicks (tyhicks)]

@Seth - This is an upstream lightdm merge request so I am modifying configure.ac and src/session-child.c directly. It is maybe a bit confusing since the upstream lightdm project contains a debian/ directory, which I've also updated accordingly in this merge.

[Robert Ancell (robert-ancell)]

Yay, yet another auditing system...

Looks fine otherwise.

review: Approve

[Sebastien Bacher (seb128)]

those changes seem to create an issue with the lockscreen, see bug #1498775

[Robert Ancell (robert-ancell)]

This has been disabled until we solve the issue in bug 1498775.

=== modified file 'configure.ac'
--- configure.ac	2015-08-16 22:44:33 +0000
+++ configure.ac	2015-09-02 01:58:24 +0000
@@ -129,6 +129,23 @@
 fi
 AM_CONDITIONAL(COMPILE_LIBLIGHTDM_QT5, test x"$compile_liblightdm_qt5" != "xno")
 
+AC_ARG_ENABLE([audit],
+    AS_HELP_STRING([--enable-audit],
+                   [Enable audit logging of login and logout events [[default=auto]]]),
+    [enable_audit=$enableval],
+    [enable_audit=auto])
+if test x"$enable_audit" != "xno"; then
+    AC_CHECK_LIB([audit], [audit_log_user_message],
+                 [AC_DEFINE(HAVE_LIBAUDIT, 1, [libaudit support])
+                  LIGHTDM_LIBS="${LIGHTDM_LIBS} -laudit"
+                 ],
+                 [if test "x$enable_audit" != xauto; then
+                    AC_MSG_FAILURE(
+                      [--enable-audit was given, but test for libaudit failed])
+                  fi
+                 ])
+fi
+
 AC_MSG_CHECKING(whether to build tests)
 AC_ARG_ENABLE(tests,
         AS_HELP_STRING([--disable-tests], [Disable tests building]),

=== modified file 'debian/changelog'
--- debian/changelog	2015-08-26 08:42:02 +0000
+++ debian/changelog	2015-09-02 01:58:24 +0000
@@ -1,3 +1,18 @@
+lightdm (1.15.3-0ubuntu4) UNRELEASED; urgency=medium
+
+  * Generate login and logout events that can be used by the Linux Audit tools
+    such as aulast and aureport (LP: #1319278) (LP: #1478087)
+    - Link against libaudit and log AUDIT_USER_LOGIN and AUDIT_USER_LOGOUT
+      events after appending entries to the wtmp file. These events go to the
+      audit log and can then be consumed by the Linux Audit tools.
+    - debian/control: Add libaudit-dev to Build-Depends
+    - debian/lightdm.pam, debian/lightdm-autologin.pam: Set the loginuid for
+      the process that is authenticating. This allows for the UID to be
+      properly set when AUDIT_USER_LOGIN and AUDIT_USER_LOGOUT events are
+      logged.
+
+ -- Tyler Hicks <[e-mail]>  Tue, 01 Sep 2015 20:37:22 -0500
+
 lightdm (1.15.3-0ubuntu3) wily; urgency=medium
 
   * debian/lightdm.postrm:

=== modified file 'debian/control'
--- debian/control	2015-08-10 04:38:18 +0000
+++ debian/control	2015-09-02 01:58:24 +0000
@@ -27,6 +27,7 @@
                gtk-doc-tools,
                yelp-tools,
                dbus,
+               libaudit-dev
 Homepage: https://launchpad.net/lightdm
 # If you aren't a member of ~lightdm-team but need to upload packaging changes,
 # just go ahead.  ~lightdm-team will notice and sync up the code again.

=== modified file 'debian/lightdm.lightdm-autologin.pam'
--- debian/lightdm.lightdm-autologin.pam	2013-07-16 23:36:16 +0000
+++ debian/lightdm.lightdm-autologin.pam	2015-09-02 01:58:24 +0000
@@ -3,6 +3,7 @@
 auth    required        pam_permit.so
 @include common-account
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
+session required        pam_loginuid.so
 session required        pam_limits.so
 @include common-session
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

=== modified file 'debian/lightdm.pam'
--- debian/lightdm.pam	2015-08-24 10:51:30 +0000
+++ debian/lightdm.pam	2015-09-02 01:58:24 +0000
@@ -7,6 +7,7 @@
 auth    optional        pam_kwallet5.so
 @include common-account
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
+session required        pam_loginuid.so
 session required        pam_limits.so
 @include common-session
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

=== modified file 'src/session-child.c'
--- src/session-child.c	2015-03-18 22:36:10 +0000
+++ src/session-child.c	2015-09-02 01:58:24 +0000
@@ -16,6 +16,7 @@
 #include <utmp.h>
 #include <utmpx.h>
 #include <sys/mman.h>
+#include <libaudit.h>
 
 #include "configuration.h"
 #include "session-child.h"
@@ -220,6 +221,32 @@
     updwtmp (wtmp_file, &u);
 }
 
+static void
+audit_event (int type, const gchar *username, uid_t uid, const gchar *remote_host_name, const gchar *tty, gboolean success)
+{
+#if HAVE_LIBAUDIT
+    int auditfd, result;
+    const char *op = NULL;
+
+    auditfd = audit_open ();
+    if (auditfd < 0) {
+        g_printerr ("Error opening audit socket: %s\n", strerror (errno));
+        return;
+    }
+
+    if (type == AUDIT_USER_LOGIN)
+        op = "login";
+    else if (type == AUDIT_USER_LOGOUT)
+        op = "logout";
+    result = success == TRUE ? 1 : 0;
+
+    if (audit_log_acct_message (auditfd, type, NULL, op, username, uid, remote_host_name, NULL, tty, result) <= 0)
+        g_printerr ("Error writing audit message: %s\n", strerror (errno));
+
+    close (auditfd);
+#endif
+}
+
 int
 session_child_run (int argc, char **argv)
 {
@@ -386,6 +413,8 @@
             ut.ut_tv.tv_usec = tv.tv_usec;
 
             updwtmpx ("/var/log/btmp", &ut);
+
+            audit_event (AUDIT_USER_LOGIN, username, -1, remote_host_name, tty, FALSE);
         }
 
         /* Check account is valid */
@@ -701,6 +730,8 @@
                 g_printerr ("Failed to write utmpx: %s\n", strerror (errno));
             endutxent ();
             updwtmpx ("/var/log/wtmp", &ut);
+
+            audit_event (AUDIT_USER_LOGIN, username, uid, remote_host_name, tty, TRUE);
         }
 
         waitpid (child_pid, &return_code, 0);
@@ -737,6 +768,8 @@
                 g_printerr ("Failed to write utmpx: %s\n", strerror (errno));
             endutxent ();
             updwtmpx ("/var/log/wtmp", &ut);
+
+            audit_event (AUDIT_USER_LOGOUT, username, uid, remote_host_name, tty, TRUE);
         }
     }