From owner-p4-projects@FreeBSD.ORG  Sat Feb  4 18:52:19 2006
Return-Path: <owner-p4-projects@FreeBSD.ORG>
X-Original-To: p4-projects@freebsd.org
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 4676A16A423; Sat,  4 Feb 2006 18:52:19 +0000 (GMT)
X-Original-To: perforce@freebsd.org
Delivered-To: perforce@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id F09D616A420
	for <perforce@freebsd.org>; Sat,  4 Feb 2006 18:52:18 +0000 (GMT)
	(envelope-from bb+lists.freebsd.perforce@cyrus.watson.org)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5688143D4C
	for <perforce@freebsd.org>; Sat,  4 Feb 2006 18:52:18 +0000 (GMT)
	(envelope-from bb+lists.freebsd.perforce@cyrus.watson.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id k14IqHTk039412
	for <perforce@freebsd.org>; Sat, 4 Feb 2006 18:52:18 GMT
	(envelope-from bb+lists.freebsd.perforce@cyrus.watson.org)
Received: (from perforce@localhost)
	by repoman.freebsd.org (8.13.1/8.13.1/Submit) id k14IqHJn039409
	for perforce@freebsd.org; Sat, 4 Feb 2006 18:52:17 GMT
	(envelope-from bb+lists.freebsd.perforce@cyrus.watson.org)
Date: Sat, 4 Feb 2006 18:52:17 GMT
Message-Id: <200602041852.k14IqHJn039409@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: perforce set sender to
	bb+lists.freebsd.perforce@cyrus.watson.org using -f
From: Robert Watson <rwatson@FreeBSD.org>
To: Perforce Change Reviews <perforce@freebsd.org>
Cc: 
Subject: PERFORCE change 91092 for review
X-BeenThere: p4-projects@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: p4 projects tree changes <p4-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/p4-projects>
List-Post: <mailto:p4-projects@freebsd.org>
List-Help: <mailto:p4-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 04 Feb 2006 18:52:20 -0000

http://perforce.freebsd.org/chv.cgi?CH=91092

Change 91092 by rwatson@rwatson_peppercorn on 2006/02/04 18:51:55

	Audit logout.

Affected files ...

.. //depot/projects/trustedbsd/audit3/usr.bin/login/login.c#11 edit
.. //depot/projects/trustedbsd/audit3/usr.bin/login/login_audit.c#4 edit

Differences ...

==== //depot/projects/trustedbsd/audit3/usr.bin/login/login.c#11 (text+ko) ====

@@ -959,6 +959,7 @@
 {
 
 	pam_cleanup();
+	audit_logout();
 	(void)sleep(sec);
 	exit(eval);
 }

==== //depot/projects/trustedbsd/audit3/usr.bin/login/login_audit.c#4 (text+ko) ====

@@ -226,3 +226,57 @@
 		exit(1);
 	}
 }
+
+/*
+ * The following tokens are included in the audit record for a logout:
+ * header, subject, return.
+ */ 
+void
+audit_logout(void)
+{
+	token_t *tok;
+	int aufd;
+	au_mask_t aumask;
+	auditinfo_t auinfo;
+	uid_t uid = pwd->pw_uid;
+	gid_t gid = pwd->pw_gid;
+	pid_t pid = getpid();
+	long au_cond;
+
+	/* If we are not auditing, don't cut an audit record; just return. */
+ 	if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
+		if (errno == ENOSYS)
+			return;
+		fprintf(stderr,
+		    "login: Could not determine audit condition\n");
+		exit(1);
+	}
+	if (au_cond == AUC_NOAUDIT)
+		return;
+
+	if ((aufd = au_open()) == -1) {
+		fprintf(stderr, "login: Audit Error: au_open() failed\n");
+		exit(1);
+	}
+
+	/* The subject that is created (euid, egid of the current process). */
+	if ((tok = au_to_subject32(uid, geteuid(), getegid(), 
+			uid, gid, pid, pid, &tid)) == NULL) {
+		fprintf(stderr, 
+		    "login: Audit Error: au_to_subject32() failed\n");
+		exit(1);
+	}
+	au_write(aufd, tok);
+
+	if ((tok = au_to_return32(0, 0)) == NULL) {
+		fprintf(stderr, 
+		    "login: Audit Error: au_to_return32() failed\n");
+		exit(1);
+	}
+	au_write(aufd, tok);
+
+	if (au_close(aufd, 1, AUE_logout) == -1) {
+		fprintf(stderr, "login: Audit Record was not committed.\n");
+		exit(1);
+	}
+}