On 14/09/03, Dmitry V. Levin wrote:
On Wed, Sep 03, 2014 at 10:30:26AM +0200, Tomas Mraz wrote:
> On St, 2014-09-03 at 07:52 +0400, Dmitry V. Levin wrote:
> > On Thu, Jul 24, 2014 at 05:29:50PM +0200, Tomas Mraz wrote:
[...]
> > > @@ -134,9 +188,18 @@ _pam_auditlog(pam_handle_t *pamh, int action, int
retval, int flags)
> > > retval = PAM_SYSTEM_ERR;
> > > }
> > >
> > > - if (_pam_audit_writelog(pamh, audit_fd, type, message, retval) < 0)
> > > + buf = _pam_list_grantors(h, message, retval);
> > > + if (buf == NULL) {
> > > + /* allocation failure */
> > > + pam_syslog(pamh, LOG_CRIT, "_pam_list_grantors() failed:
%m");
> > > + retval = PAM_SYSTEM_ERR;
> > > + }
> >
> > Since there are no grantors when retval != PAM_SUCCESS, we can make
> > _pam_list_grantors simpler and save on extra asprintf/free by calling
> > _pam_list_grantors only if retval == PAM_SUCCESS.
> >
> > No need to print "grantor=?" when there are no grantors.
>
> This was explicitly requested to make the audit record more orthogonal.
> So I will keep it as is.
Still there is a slight chance of _pam_list_grantors returning NULL, so
there would be two kinds of messages, with and without mentioning
grantors, anyway. For me "grantor=?" in the case when there are no
grantors just looks confusing.
In that case, Steve Grubb has requested something like "grantor=(none)"
so that there are no disappearing fields in audit records.
ldv
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545