GNOME Bugzilla – Bug 349835
linux login auditing support
Last modified: 2007-06-04 14:38:33 UTC
In fedora/rhel we have a patch add support for using linux audit libs to audit login failures and successes (written by Steve Grubb). The patch probably isn't ready to be commited upstream because it doesn't integrate well with the existing solaris adt support. Still i want to get it posted here so it doesn't languish away in the fedora package cvs and when I refactor things I'll post a new patch on this report.
Created attachment 70158 [details] [review] linux login auditing support
Thanks. The patch looks good to me, although it would be nicer if we abstracted this a bit (if possible) so that Solaris ADT and Linux auditing were handled more generically if possible. Sounds like you have some ideas about this.
So I haven't had a chance to work on this more, but another issue is gdm_verify_check is causing auditing problems: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230401
Ray, the comment in gdm_verify_check says: * Check that the authentication system is correctly configured. * Not very smart, perhaps we should just whack this. I'd be agreeable to remove this function since it is causing problems on Red Hat, and I don't think the function is very useful. If you want to commit a patch that removes this function, go ahead.
Created attachment 84167 [details] [review] empty out the function Sure, I guess it will have to wait until after code freeze though. Adding the trivial patch to this bug report with the right status so that it doesn't drop off my radar.
Created attachment 88619 [details] [review] patch updated to 2.19.1
Ray. I committed this patch now that we are in the 2.19 development cycle. Thanks Matthias for updating the patch. I also removed the gdm_verify_check function as discussed so we don't create the spurious audit record, as we discussed. You mentioned that it would be nice to better abstract the auditing (ADT and Linux) so that the code is more clean. If you want to do work on this, that would be appreciated...but we can handle this in a separate bug for code cleanup.
Ah, makes a lot of sense, thanks. (Sorry for letting this bug linger)
(And welcome back from vacation!)