author | Shawn Emery <shawn.emery@oracle.com> |
Sat, 17 Dec 2016 21:18:50 -0800 | |
changeset 7504 | 49f3285e13a3 |
permissions | -rw-r--r-- |
7504
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
1 |
# |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
2 |
# This patch provides a check to see if bsm is supported and if so then |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
3 |
# configures the build for the KRB5KDC audit plugin support for Solaris based |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
4 |
# systems. |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
5 |
# |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
6 |
# The patch also builds a temporary audit module for kadmind that provides a |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
7 |
# temporary solution until an adminstrative plugin framework is available, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
8 |
# upstream. |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
9 |
# |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
10 |
# This patch is not intended to be contributed to MIT as the changes are Solaris |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
11 |
# specific and, in the case for kadmind, a temporary solution. |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
12 |
# |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
13 |
# Patch source: in-house |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
14 |
# |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
15 |
--- a/src/config/pre.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
16 |
+++ b/src/config/pre.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
17 |
@@ -212,6 +212,7 @@ MODULE_DIR = @libdir@/krb5/plugins |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
18 |
KRB5_DB_MODULE_DIR = $(MODULE_DIR)/kdb |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
19 |
KRB5_PA_MODULE_DIR = $(MODULE_DIR)/preauth |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
20 |
KRB5_AD_MODULE_DIR = $(MODULE_DIR)/authdata |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
21 |
+KRB5_AU_MODULE_DIR = $(MODULE_DIR)/audit |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
22 |
KRB5_LIBKRB5_MODULE_DIR = $(MODULE_DIR)/libkrb5 |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
23 |
KRB5_TLS_MODULE_DIR = $(MODULE_DIR)/tls |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
24 |
KRB5_LOCALEDIR = @localedir@ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
25 |
--- a/src/configure.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
26 |
+++ b/src/configure.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
27 |
@@ -188,7 +188,7 @@ if test "$withval" = yes; then |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
28 |
fi |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
29 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
30 |
# Check which (if any) audit plugin to build |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
31 |
-audit_plugin="" |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
32 |
+audit_plugin="solaris" |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
33 |
AC_ARG_ENABLE([audit-plugin], |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
34 |
AC_HELP_STRING([--enable-audit-plugin=IMPL], |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
35 |
[use audit plugin @<:@ do not use audit @:>@]), , enableval=no) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
36 |
@@ -203,6 +203,13 @@ if test "$enableval" != no; then |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
37 |
audit_plugin=plugins/audit/simple ], |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
38 |
AC_MSG_ERROR([libaudit not found or undefined symbol audit_log_user_message])) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
39 |
;; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
40 |
+ solaris) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
41 |
+ AC_CHECK_LIB(bsm, adt_start_session, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
42 |
+ [AUDIT_IMPL_LIBS=-lbsm |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
43 |
+ K5_GEN_MAKEFILE(plugins/audit/solaris) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
44 |
+ audit_plugin=plugins/audit/solaris ], |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
45 |
+ AC_MSG_ERROR([bsm not found or undefined symbol adt_start_session])) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
46 |
+ ;; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
47 |
*) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
48 |
AC_MSG_ERROR([Unknown audit plugin implementation $enableval.]) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
49 |
;; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
50 |
--- a/src/kadmin/server/deps |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
51 |
+++ b/src/kadmin/server/deps |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
52 |
@@ -132,4 +132,23 @@ $(OUTPRE)ipropd_svc.$(OBJEXT): $(BUILDTO |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
53 |
$(top_srcdir)/include/kdb_log.h $(top_srcdir)/include/krb5.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
54 |
$(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/net-server.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
55 |
$(top_srcdir)/lib/gssapi/krb5/gssapi_krb5.h $(top_srcdir)/lib/kadm5/srv/server_acl.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
56 |
- ipropd_svc.c misc.h |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
57 |
+ ipropd_svc.c misc.h kadmind_audit.h |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
58 |
+$(OUTPRE)kadmind_audit.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
59 |
+ $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_ext.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
60 |
+ $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
61 |
+ $(BUILDTOP)/include/kadm5/admin_internal.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
62 |
+ $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/kadm5/kadm_rpc.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
63 |
+ $(BUILDTOP)/include/kadm5/server_internal.h $(BUILDTOP)/include/krb5/krb5.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
64 |
+ $(BUILDTOP)/include/osconf.h $(COM_ERR_DEPS) $(VERTO_DEPS) \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
65 |
+ $(top_srcdir)/include/adm_proto.h $(top_srcdir)/include/gssrpc/auth.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
66 |
+ $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
67 |
+ $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
68 |
+ $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
69 |
+ $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
70 |
+ $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/iprop.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
71 |
+ $(top_srcdir)/include/iprop_hdr.h $(top_srcdir)/include/k5-platform.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
72 |
+ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
73 |
+ $(top_srcdir)/include/kdb_log.h $(top_srcdir)/include/krb5.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
74 |
+ $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/net-server.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
75 |
+ $(top_srcdir)/lib/gssapi/krb5/gssapi_krb5.h $(top_srcdir)/lib/kadm5/srv/server_acl.h \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
76 |
+ kadmind_audit.c kadmind_audit.h |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
77 |
--- a/src/kadmin/server/ipropd_svc.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
78 |
+++ b/src/kadmin/server/ipropd_svc.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
79 |
@@ -191,6 +191,9 @@ iprop_get_updates_1_svc(kdb_last_t *arg, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
80 |
DPRINT("%s: PERMISSION DENIED: clprinc=`%s'\n\tsvcprinc=`%s'\n", |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
81 |
whoami, client_name, service_name); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
82 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
83 |
+ audit_kadmind("Incremental updates", "null", client_name, service_name, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
84 |
+ "Unauthorized request", rqstp->rq_xprt, ret.ret); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
85 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
86 |
krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, whoami, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
87 |
client_name, service_name, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
88 |
client_addr(rqstp->rq_xprt)); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
89 |
@@ -217,6 +220,10 @@ iprop_get_updates_1_svc(kdb_last_t *arg, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
90 |
((kret == 0) ? "success" : error_message(kret)), |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
91 |
client_name, service_name); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
92 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
93 |
+ audit_kadmind("Incremental updates", "null", client_name, service_name, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
94 |
+ ((kret == 0) ? "success" : (char *)error_message(kret)), rqstp->rq_xprt, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
95 |
+ ret.ret); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
96 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
97 |
krb5_klog_syslog(LOG_NOTICE, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
98 |
_("Request: %s, %s, %s, client=%s, service=%s, addr=%s"), |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
99 |
whoami, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
100 |
@@ -336,6 +343,10 @@ ipropx_resync(uint32_t vers, struct svc_ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
101 |
ret.ret = UPDATE_PERM_DENIED; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
102 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
103 |
DPRINT("%s: Permission denied\n", whoami); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
104 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
105 |
+ audit_kadmind("Full resync", "null", client_name, service_name, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
106 |
+ "Unauthorized request", rqstp->rq_xprt, ret.ret); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
107 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
108 |
krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, whoami, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
109 |
client_name, service_name, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
110 |
client_addr(rqstp->rq_xprt)); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
111 |
@@ -444,6 +455,10 @@ ipropx_resync(uint32_t vers, struct svc_ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
112 |
DPRINT("%s: spawned resync process %d, client=%s, " |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
113 |
"service=%s, addr=%s\n", whoami, fret, client_name, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
114 |
service_name, client_addr(rqstp->rq_xprt)); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
115 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
116 |
+ audit_kadmind("Full resync", "null", client_name, service_name, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
117 |
+ "success", rqstp->rq_xprt, ret.ret); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
118 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
119 |
krb5_klog_syslog(LOG_NOTICE, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
120 |
_("Request: %s, spawned resync process %d, client=%s, service=%s, addr=%s"), |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
121 |
whoami, fret, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
122 |
--- a/src/kadmin/server/Makefile.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
123 |
+++ b/src/kadmin/server/Makefile.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
124 |
@@ -7,13 +7,15 @@ LOCALINCLUDES = -I$(top_srcdir)/lib/gssa |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
125 |
-I$(BUILDTOP)/lib/gssapi/krb5 -I$(top_srcdir)/lib/kadm5/srv |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
126 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
127 |
PROG = kadmind |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
128 |
-OBJS = kadm_rpc_svc.o server_stubs.o ovsec_kadmd.o schpw.o misc.o ipropd_svc.o |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
129 |
-SRCS = kadm_rpc_svc.c server_stubs.c ovsec_kadmd.c schpw.c misc.c ipropd_svc.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
130 |
+OBJS = kadm_rpc_svc.o server_stubs.o ovsec_kadmd.o schpw.o misc.o ipropd_svc.o \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
131 |
+ kadmind_audit.o |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
132 |
+SRCS = kadm_rpc_svc.c server_stubs.c ovsec_kadmd.c schpw.c misc.c ipropd_svc.c \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
133 |
+ kadmind_audit.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
134 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
135 |
all:: $(PROG) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
136 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
137 |
$(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) $(APPUTILS_DEPLIB) $(VERTO_DEPLIB) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
138 |
- $(CC_LINK) -o $(PROG) $(OBJS) $(APPUTILS_LIB) $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) $(VERTO_LIBS) -lpam |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
139 |
+ $(CC_LINK) -o $(PROG) $(OBJS) $(APPUTILS_LIB) $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) $(VERTO_LIBS) -lpam -lbsm |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
140 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
141 |
install:: |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
142 |
$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(SERVER_BINDIR)/$(PROG) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
143 |
--- a/src/kadmin/server/misc.h |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
144 |
+++ b/src/kadmin/server/misc.h |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
145 |
@@ -8,6 +8,7 @@ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
146 |
#define _MISC_H 1 |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
147 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
148 |
#include "net-server.h" /* for krb5_fulladdr */ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
149 |
+#include "kadmind_audit.h" |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
150 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
151 |
int |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
152 |
setup_gss_names(struct svc_req *, gss_buffer_desc *, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
153 |
--- a/src/kadmin/server/server_stubs.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
154 |
+++ b/src/kadmin/server/server_stubs.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
155 |
@@ -312,6 +312,29 @@ log_unauth( |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
156 |
slen = server->length; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
157 |
trunc_name(&slen, &sdots); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
158 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
159 |
+ { |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
160 |
+ char *client_str = NULL, *server_str = NULL; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
161 |
+ int len; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
162 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
163 |
+ len = asprintf(&client_str, "%.*s%s", (int)clen, (char *)client->value, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
164 |
+ cdots); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
165 |
+ if (len == -1) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
166 |
+ return ENOMEM; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
167 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
168 |
+ len = asprintf(&server_str, "%.*s%s", (int)slen, (char *)server->value, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
169 |
+ sdots); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
170 |
+ if (len == -1) { |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
171 |
+ free(client_str); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
172 |
+ return ENOMEM; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
173 |
+ } |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
174 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
175 |
+ audit_kadmind(op, target, client_str, server_str, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
176 |
+ _("Unauthorized request"), rqstp->rq_xprt, 1); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
177 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
178 |
+ free(client_str); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
179 |
+ free(server_str); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
180 |
+ } |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
181 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
182 |
/* okay to cast lengths to int because trunc_name limits max value */ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
183 |
return krb5_klog_syslog(LOG_NOTICE, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
184 |
_("Unauthorized request: %s, %.*s%s, " |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
185 |
@@ -343,6 +366,29 @@ log_done( |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
186 |
slen = server->length; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
187 |
trunc_name(&slen, &sdots); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
188 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
189 |
+ { |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
190 |
+ char *client_str = NULL, *server_str = NULL; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
191 |
+ int len; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
192 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
193 |
+ len = asprintf(&client_str, "%.*s%s", (int)clen, (char *)client->value, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
194 |
+ cdots); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
195 |
+ if (len == -1) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
196 |
+ return ENOMEM; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
197 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
198 |
+ len = asprintf(&server_str, "%.*s%s", (int)slen, (char *)server->value, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
199 |
+ sdots); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
200 |
+ if (len == -1) { |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
201 |
+ free(client_str); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
202 |
+ return ENOMEM; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
203 |
+ } |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
204 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
205 |
+ audit_kadmind(op, target, client_str, server_str, (char *)errmsg, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
206 |
+ rqstp->rq_xprt, strcmp("success", errmsg) ? 1 : 0); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
207 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
208 |
+ free(client_str); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
209 |
+ free(server_str); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
210 |
+ } |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
211 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
212 |
/* okay to cast lengths to int because trunc_name limits max value */ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
213 |
return krb5_klog_syslog(LOG_NOTICE, |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
214 |
_("Request: %s, %.*s%s, %s, " |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
215 |
--- a/src/kdc/kdc_audit.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
216 |
+++ b/src/kdc/kdc_audit.c |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
217 |
@@ -80,6 +80,11 @@ load_audit_modules(krb5_context context) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
218 |
if (context == NULL || handles != NULL) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
219 |
return EINVAL; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
220 |
|
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
221 |
+ ret = k5_plugin_register_dyn(context, PLUGIN_INTERFACE_AUDIT, "solaris", |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
222 |
+ "audit"); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
223 |
+ if (ret) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
224 |
+ return ret; |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
225 |
+ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
226 |
/* Get audit plugin vtable. */ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
227 |
ret = k5_plugin_load_all(context, PLUGIN_INTERFACE_AUDIT, &modules); |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
228 |
if (ret) |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
229 |
--- a/src/Makefile.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
230 |
+++ b/src/Makefile.in |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
231 |
@@ -65,7 +65,7 @@ INSTALLMKDIRS = $(KRB5ROOT) $(KRB5MANROO |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
232 |
$(FILE_CATDIR) \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
233 |
$(KRB5_LIBDIR) $(KRB5_INCDIR) \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
234 |
$(KRB5_DB_MODULE_DIR) $(KRB5_PA_MODULE_DIR) \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
235 |
- $(KRB5_AD_MODULE_DIR) \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
236 |
+ $(KRB5_AD_MODULE_DIR) $(KRB5_AU_MODULE_DIR) \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
237 |
$(KRB5_LIBKRB5_MODULE_DIR) $(KRB5_TLS_MODULE_DIR) \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
238 |
@localstatedir@ @localstatedir@/krb5kdc \ |
49f3285e13a3
24435657 Provide Solaris audit plugin for MIT Kerberos KDC
Shawn Emery <shawn.emery@oracle.com>
parents:
diff
changeset
|
239 |
@runstatedir@ @runstatedir@/krb5kdc \ |