Skip to content

Commit cd195a5

Browse files
authored
[202305] Fix TACACS local accounting disabled when debug flag disabled. (#19061)
Why I did it TACACS accounting trace log is only for debug, improve code to not generate trace log when debug disabled. Manually cherry-pick following 2 PR, because fir PR has a code bug, PR validation will block it: #16482 #18357 Work item tracking Microsoft ADO: 25270078 How I did it Ignore TACACS accounting trace log when debug disabled. How to verify it Pass all UT. Manually verified the auditd-tacplus not generate trace log when debug disabled.
1 parent d7ae517 commit cd195a5

File tree

2 files changed

+15
-5
lines changed

2 files changed

+15
-5
lines changed

src/tacacs/audisp/patches/0002-Remove-user-secret-from-accounting-log.patch

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,15 @@ Subject: [PATCH] Remove user secret from accounting log.
1313
regex_helper.h | 17 +++
1414
sudoers_helper.c | 250 +++++++++++++++++++++++++++++++++++++++
1515
sudoers_helper.h | 18 +++
16-
trace.c | 21 ++++
16+
trace.c | 31 +++++
1717
trace.h | 10 ++
1818
unittest/Makefile | 21 ++++
1919
unittest/mock.h | 17 +++
2020
unittest/mock_helper.c | 65 ++++++++++
2121
unittest/mock_helper.h | 48 ++++++++
2222
unittest/password_test.c | 199 +++++++++++++++++++++++++++++++
2323
unittest/sudoers | 5 +
24-
17 files changed, 931 insertions(+), 4 deletions(-)
24+
17 files changed, 941 insertions(+), 4 deletions(-)
2525
create mode 100644 password.c
2626
create mode 100644 password.h
2727
create mode 100644 regex_helper.c
@@ -700,7 +700,7 @@ new file mode 100644
700700
index 0000000..44bbbc7
701701
--- /dev/null
702702
+++ b/trace.c
703-
@@ -0,0 +1,21 @@
703+
@@ -0,0 +1,31 @@
704704
+#include <stdarg.h>
705705
+#include <stdio.h>
706706
+#include <string.h>
@@ -709,9 +709,19 @@ index 0000000..44bbbc7
709709
+
710710
+#include "trace.h"
711711
+
712+
+/* Tacacs+ support lib */
713+
+#include <libtac/support.h>
714+
+
715+
+/* Tacacs control flag */
716+
+extern int tacacs_ctrl;
717+
+
712718
+/* Output trace log. */
713719
+void trace(const char *format, ...)
714720
+{
721+
+ if ((tacacs_ctrl & PAM_TAC_DEBUG) == 0) {
722+
+ return;
723+
+ }
724+
+
715725
+ // convert log to a string because va args resoursive issue:
716726
+ // http://www.c-faq.com/varargs/handoff.html
717727
+ char logBuffer[MAX_LINE_SIZE];

src/tacacs/audisp/patches/0003-Add-local-accounting.patch

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,12 +70,12 @@ index 0000000..e23acec
7070
+#include "trace.h"
7171
+
7272
+/* Accounting log format. */
73-
+#define ACCOUNTING_LOG_FORMAT "Accounting: user: %s, tty: %s, host: %s, command: %s, type: %d, task ID: %d"
73+
+#define ACCOUNTING_LOG_FORMAT "Audisp-tacplus: Accounting: user: %s, tty: %s, host: %s, command: %s, type: %d, task ID: %d"
7474
+
7575
+/* Write the accounting information to syslog. */
7676
+void accounting_to_syslog(char *user, char *tty, char *host, char *cmdmsg, int type, uint16_t task_id)
7777
+{
78-
+ trace(ACCOUNTING_LOG_FORMAT, user, tty, host, cmdmsg, type, task_id);
78+
+ syslog(LOG_INFO, ACCOUNTING_LOG_FORMAT, user, tty, host, cmdmsg, type, task_id);
7979
+}
8080
\ No newline at end of file
8181
diff --git a/local_accounting.h b/local_accounting.h

0 commit comments

Comments
 (0)