--- util-linux-2.13-pre2/hwclock/hwclock.c.audit 2005-07-31 22:15:18.000000000 +0200 +++ util-linux-2.13-pre2/hwclock/hwclock.c 2005-08-30 11:11:11.000000000 +0200 @@ -81,9 +81,11 @@ #include #include #include +#include #include "clock.h" #include "nls.h" +#include "audit.h" #define MYNAME "hwclock" @@ -1234,7 +1236,7 @@ va_end(ap); } - exit(fmt ? EX_USAGE : 0); + audit_exit(fmt ? EX_USAGE : 0); } static const struct option longopts[] = { @@ -1298,6 +1300,15 @@ /* Remember what time we were invoked */ gettimeofday(&startup_time, NULL); + audit_fd = audit_open(); + if (audit_fd < 0 && !(errno == EINVAL || errno == EPROTONOSUPPORT || + errno == EAFNOSUPPORT)) { + /* You get these error codes only when the kernel doesn't have + * audit compiled in. */ + fprintf(stderr, "Error - unable to connect to audit system\n"); + return EX_NOPERM; + } + setlocale(LC_ALL, ""); #ifdef LC_NUMERIC /* We need LC_CTYPE and LC_TIME and LC_MESSAGES, but must avoid @@ -1393,6 +1404,13 @@ argc -= optind; argv += optind; + if (testing != TRUE) { + if (adjust == TRUE || hctosys == TRUE || systohc == TRUE || + set == TRUE || setepoch == TRUE) { + auditable_event(1); + } + } + if (argc > 0) { usage(_("%s takes no non-option arguments. " "You supplied %d.\n"), @@ -1403,27 +1421,27 @@ fprintf(stderr, _("You have specified multiple functions.\n" "You can only perform one function " "at a time.\n")); - exit(EX_USAGE); + audit_exit(EX_USAGE); } if (utc && local_opt) { fprintf(stderr, _("%s: The --utc and --localtime options " "are mutually exclusive. You specified " "both.\n"), MYNAME); - exit(EX_USAGE); + audit_exit(EX_USAGE); } if (adjust && noadjfile) { fprintf(stderr, _("%s: The --adjust and --noadjfile options " "are mutually exclusive. You specified " "both.\n"), MYNAME); - exit(EX_USAGE); + audit_exit(EX_USAGE); } if (noadjfile && !(utc || local_opt)) { fprintf(stderr, _("%s: With --noadjfile, you must specify " "either --utc or --localtime\n"), MYNAME); - exit(EX_USAGE); + audit_exit(EX_USAGE); } #ifdef __alpha__ @@ -1437,7 +1455,7 @@ if (rc != 0) { fprintf(stderr, _("No usable set-to time. " "Cannot set clock.\n")); - exit(EX_USAGE); + audit_exit(EX_USAGE); } } @@ -1469,11 +1487,11 @@ } if (!permitted) - exit(EX_NOPERM); + audit_exit(EX_NOPERM); if (getepoch || setepoch) { manipulate_epoch(getepoch, setepoch, epoch_option, testing); - return 0; + audit_exit(0); } if (debug) @@ -1487,12 +1505,14 @@ fprintf(stderr, _("Use the --debug option to see the details " "of our search for an access method.\n")); - exit(1); + audit_exit(1); } - return manipulate_clock(show, adjust, noadjfile, set, set_time, + rc = manipulate_clock(show, adjust, noadjfile, set, set_time, hctosys, systohc, startup_time, utc, local_opt, testing); + audit_exit(rc); + return rc; /* Not reached */ } /* A single routine for greater uniformity */ --- /dev/null 2005-08-29 11:11:19.415613608 +0200 +++ util-linux-2.13-pre2/hwclock/audit.c 2005-08-30 11:10:38.000000000 +0200 @@ -0,0 +1,73 @@ +/* audit.c -- This file contains the audit system extensions + * + * Copyright 2005 Red Hat Inc., Durham, North Carolina. + * All Rights Reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Authors: + * Steve Grubb + */ + +#include +#include +#include +#include +#include +#include "audit.h" + +int audit_fd = -1; + +/* + * This function will log a message to the audit system using a predefined + * message format. Parameter usage is as follows: + * + * op - operation. "adding user", "changing finger info", "deleting group" + * result - 0 = "success" or 1 = "failed" + */ +static void audit_logger(const char *op, int result) +{ + char msg_buf[256]; /* Common buffer for messaging */ + const char *success; + extern char *progname; + + if (audit_fd < 0) + return; /* kernel without audit support */ + + if (!result) + success = "success"; + else + success = "failed"; + + /* Add some audit info & log it. */ + snprintf(msg_buf, sizeof(msg_buf), + "%s: op=%s id=%u res=%s", progname, op, getuid(), success); + audit_send_user_message(audit_fd, AUDIT_USYS_CONFIG, msg_buf); + close(audit_fd); +} + +static int audit_this = 0; +void auditable_event(int i) +{ + audit_this = i; +} + +void audit_exit(int status) +{ + if (audit_this) + audit_logger("changing system time", status); + exit(status); +} + --- util-linux-2.13-pre2/hwclock/kd.c.audit 2005-07-31 18:01:20.000000000 +0200 +++ util-linux-2.13-pre2/hwclock/kd.c 2005-08-30 11:06:38.000000000 +0200 @@ -19,6 +19,7 @@ #include "clock.h" #include "nls.h" +#include "audit.h" static int con_fd = -1; /* opened by probe_for_kd_clock() */ /* never closed */ @@ -103,7 +104,7 @@ if (ioctl(con_fd, KDGHWCLK, &t) == -1) { outsyserr(_("ioctl() failed to read time from %s"), con_fd_filename); - exit(EX_IOERR); + audit_exit(EX_IOERR); } tm->tm_sec = t.sec; @@ -139,7 +140,7 @@ if (ioctl(con_fd, KDSHWCLK, &t ) == -1) { outsyserr(_("ioctl KDSHWCLK failed")); - exit(1); + audit_exit(1); } return 0; } --- util-linux-2.13-pre2/hwclock/Makefile.am.audit 2005-01-30 00:18:46.000000000 +0100 +++ util-linux-2.13-pre2/hwclock/Makefile.am 2005-08-30 11:06:38.000000000 +0200 @@ -4,4 +4,5 @@ sbin_PROGRAMS = hwclock -hwclock_SOURCES = hwclock.c cmos.c rtc.c kd.c \ Chybí znak konce řádku na konci souboru +hwclock_SOURCES = hwclock.c cmos.c rtc.c kd.c audit.c +hwclock_LDADD = -laudit \ Chybí znak konce řádku na konci souboru --- /dev/null 2005-08-29 11:11:19.415613608 +0200 +++ util-linux-2.13-pre2/hwclock/audit.h 2005-08-30 11:06:38.000000000 +0200 @@ -0,0 +1,34 @@ +/* audit.h -- This file contains the function prototypes for audit calls + * Copyright 2005 Red Hat Inc., Durham, North Carolina. + * All Rights Reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: + * Steve Grubb + * + */ + +#ifndef HW_AUDIT_H +#define HW_AUDIT_H + +/* This is the file descriptor used by the audit system */ +extern int audit_fd; + +/* This is the logging functions */ +void auditable_event(int i); +void audit_exit(int status); + +#endif --- util-linux-2.13-pre2/hwclock/clock.h.audit 2000-12-07 17:39:53.000000000 +0100 +++ util-linux-2.13-pre2/hwclock/clock.h 2005-08-30 11:06:38.000000000 +0200 @@ -24,7 +24,12 @@ extern char *progname; extern int debug; extern int epoch_option; -extern void outsyserr(char *msg, ...); +extern void outsyserr(char *msg, ...) +#ifdef __GNUC__ + __attribute__ ((format (printf, 1, 2))); +#else + ; +#endif /* cmos.c */ extern void set_cmos_epoch(int ARCconsole, int SRM); --- util-linux-2.13-pre2/hwclock/rtc.c.audit 2005-07-31 22:15:45.000000000 +0200 +++ util-linux-2.13-pre2/hwclock/rtc.c 2005-08-30 11:06:38.000000000 +0200 @@ -8,6 +8,7 @@ #include "clock.h" #include "nls.h" +#include "audit.h" /* * Get defines for rtc stuff. @@ -114,7 +115,7 @@ if (rtc_fd < 0) { outsyserr(_("open() of %s failed"), rtc_dev_name); - exit(EX_OSFILE); + audit_exit(EX_OSFILE); } return rtc_fd; } @@ -149,7 +150,7 @@ perror(ioctlname); fprintf(stderr, _("ioctl() to %s to read the time failed.\n"), rtc_dev_name); - exit(EX_IOERR); + audit_exit(EX_IOERR); } tm->tm_isdst = -1; /* don't know whether it's dst */ @@ -329,7 +330,7 @@ perror(ioctlname); fprintf(stderr, _("ioctl() to %s to set the time failed.\n"), rtc_dev_name); - exit(EX_IOERR); + audit_exit(EX_IOERR); } if (debug)