>From d25d9bf48f62d35f88cee189fd3410dc1083167d Mon Sep 17 00:00:00 2001 From: Richard Guy Briggs Date: Thu, 21 Mar 2013 00:56:51 -0400 Subject: [PATCH] pam_tty_audit: add an option to control logging of passwords To: linux-audit@redhat.com Most commands are entered one line at a time and processed as complete lines in non-canonical mode. Commands that interactively require a password, enter canonical mode to do this. This feature (icanon) can be used to avoid logging passwords by audit while still logging the rest of the command. Adding a member to the struct audit_tty_status passed in by pam_tty_audit allows control of canonical mode per task. Signed-off-by: Richard Guy Briggs --- modules/pam_tty_audit/pam_tty_audit.8.xml | 13 +++++++++++++ modules/pam_tty_audit/pam_tty_audit.c | 9 +++++++-- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/modules/pam_tty_audit/pam_tty_audit.8.xml b/modules/pam_tty_audit/pam_tty_audit.8.xml index 447b845..deb494d 100644 --- a/modules/pam_tty_audit/pam_tty_audit.8.xml +++ b/modules/pam_tty_audit/pam_tty_audit.8.xml @@ -77,6 +77,17 @@ + + + + + + + Log keystrokes in ICANON mode. By default, keystrokes in ICANON + mode are not logged to avoid logging passwords. + + + @@ -161,6 +172,8 @@ session required pam_tty_audit.so disable=* enable=root pam_tty_audit was written by Miloslav Trmač <mitr@redhat.com>. + The log_icanon option was added by Richard Guy Briggs + <rgb@redhat.com>. diff --git a/modules/pam_tty_audit/pam_tty_audit.c b/modules/pam_tty_audit/pam_tty_audit.c index 080f495..8eb4234 100644 --- a/modules/pam_tty_audit/pam_tty_audit.c +++ b/modules/pam_tty_audit/pam_tty_audit.c @@ -200,7 +200,7 @@ pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char **argv) enum command command; struct audit_tty_status *old_status, new_status; const char *user; - int i, fd, open_only; + int i, fd, open_only, log_icanon; (void)flags; @@ -212,6 +212,7 @@ pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char **argv) command = CMD_NONE; open_only = 0; + log_icanon = 0; for (i = 0; i < argc; i++) { if (strncmp (argv[i], "enable=", 7) == 0 @@ -237,6 +238,8 @@ pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char **argv) } else if (strcmp (argv[i], "open_only") == 0) open_only = 1; + else if (strcmp (argv[i], "log_icanon") == 0) + log_icanon = 1; else { pam_syslog (pamh, LOG_ERR, "unknown option `%s'", argv[i]); @@ -262,7 +265,9 @@ pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char **argv) } new_status.enabled = (command == CMD_ENABLE ? 1 : 0); - if (old_status->enabled == new_status.enabled) + new_status.log_icanon = log_icanon; + if (old_status->enabled == new_status.enabled + && old_status->log_icanon == new_status.log_icanon) { open_only = 1; /* to clean up old_status */ goto ok_fd; -- 1.7.1