mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-28 12:58:07 +00:00
Code Issues Releases Wiki Activity

(from jmichael@suse.de)

Browse Source 
This patch adds support for a 'debug' flag to the pam_apparmor pam
module, which will cause it to report more of its attempted operations
to syslog.
This commit is contained in:
Steve Beattie 2006-10-31 16:33:02 +00:00
parent 8cf0339798
commit 53f1a9cdc5
4 changed files with 22 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changehat/pam_apparmor/README
View File

@ -60,6 +60,10 @@ Some exmaple configurations:
# DEFAULT if the prior hats do not exist in the apparmor profile # DEFAULT if the prior hats do not exist in the apparmor profile
session optional pam_apparmor.so order=user,group,default session optional pam_apparmor.so order=user,group,default
You can also add a 'debug' flag to the pam_apparmor session line; this
will cause the pam module to report more of what it is attempting to do
to syslog.
References References
---------- ----------
Project webpage: Project webpage:

9
changehat/pam_apparmor/get_options.c
View File

@ -53,8 +53,7 @@
#include "pam_apparmor.h" #include "pam_apparmor.h"
#define DEBUG 1 #define DEBUG_STRING "debug"
#define ORDER_PREFIX "order=" #define ORDER_PREFIX "order="
static int parse_option(pam_handle_t *pamh, struct config **config, const char *argv) static int parse_option(pam_handle_t *pamh, struct config **config, const char *argv)
@ -64,8 +63,10 @@ static int parse_option(pam_handle_t *pamh, struct config **config, const char *
if (argv == NULL || argv[0] == '\0') if (argv == NULL || argv[0] == '\0')
return 0; return 0;
/* someday we may have more option. Gasp! */ if (strcasecmp(argv, DEBUG_STRING) == 0) {
if (strncasecmp(argv, ORDER_PREFIX, strlen(ORDER_PREFIX)) != 0) { debug_flag = 1;
return 0;
} else if (strncasecmp(argv, ORDER_PREFIX, strlen(ORDER_PREFIX)) != 0) {
pam_syslog (pamh, LOG_ERR, "Unknown option: `%s'\n", argv); pam_syslog (pamh, LOG_ERR, "Unknown option: `%s'\n", argv);
return PAM_SESSION_ERR; return PAM_SESSION_ERR;
} }

27
changehat/pam_apparmor/pam_apparmor.c
View File

@ -38,7 +38,7 @@
#include "pam_apparmor.h" #include "pam_apparmor.h"
#define DEBUG 0 int debug_flag = 0;
static struct config default_config = { static struct config default_config = {
.hat_type[0] = eGroupname, .hat_type[0] = eGroupname,
@ -115,21 +115,18 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags,
const char *hat = NULL; const char *hat = NULL;
switch (config->hat_type[i]) { switch (config->hat_type[i]) {
case eGroupname: case eGroupname:
#if DEBUG
pam_syslog(pamh, LOG_DEBUG, "Using groupname\n");
#endif
hat = gr->gr_name; hat = gr->gr_name;
if (debug_flag)
pam_syslog(pamh, LOG_DEBUG, "Using groupname '%s'\n", hat);
break; break;
case eUsername: case eUsername:
#if DEBUG
pam_syslog(pamh, LOG_DEBUG, "Using username\n");
#endif
hat = user; hat = user;
if (debug_flag)
pam_syslog(pamh, LOG_DEBUG, "Using username '%s'\n", hat);
break; break;
case eDefault: case eDefault:
#if DEBUG if (debug_flag)
pam_syslog(pamh, LOG_DEBUG, "Using DEFAULT\n"); pam_syslog(pamh, LOG_DEBUG, "Using DEFAULT\n");
#endif
hat = "DEFAULT"; hat = "DEFAULT";
break; break;
default: default:
@ -142,9 +139,8 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags,
retval = change_hat(hat, magic_token); retval = change_hat(hat, magic_token);
if (retval == 0) { if (retval == 0) {
/* success, let's bail */ /* success, let's bail */
#if DEBUG if (debug_flag)
pam_syslog(pamh, LOG_DEBUG, "Successfully changed to hat '%s'\n", hat); pam_syslog(pamh, LOG_DEBUG, "Successfully changed to hat '%s'\n", hat);
#endif
goto out; goto out;
} }
@ -155,10 +151,9 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags,
case EINVAL: case EINVAL:
/* apparmor is not loaded or application is unconfined, /* apparmor is not loaded or application is unconfined,
* stop attempting to use change_hat */ * stop attempting to use change_hat */
#if DEBUG if (debug_flag)
pam_syslog(pamh, LOG_DEBUG, pam_syslog(pamh, LOG_DEBUG,
"AppArmor not loaded, or application is unconfined\n"); "AppArmor not loaded, or application is unconfined\n");
#endif
pam_retval = PAM_SUCCESS; pam_retval = PAM_SUCCESS;
goto out; goto out;
break; break;

2
changehat/pam_apparmor/pam_apparmor.h
View File

@ -52,5 +52,7 @@ struct config {
hat_t hat_type[MAX_HAT_TYPES]; hat_t hat_type[MAX_HAT_TYPES];
}; };
extern int debug_flag;
extern int get_options(pam_handle_t *pamh, struct config **config, extern int get_options(pam_handle_t *pamh, struct config **config,
int argc, const char **argv); int argc, const char **argv);