-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
confd: fix audit logs using proper facility
The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for details. This caused all audit log messages to be logged in LOG_USER. Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT() to match RFC5424 terminology. Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING. Additionally, drop the leading [severity] prefix to sysrepo logs. Only needed when logging to stdout. Follow-up to issue #521 Signed-off-by: Joachim Wiberg <[email protected]>
- Loading branch information
Showing
5 changed files
with
77 additions
and
45 deletions.
There are no files selected for viewing
54 changes: 43 additions & 11 deletions
54
....1/0007-Introduce-new-log-level-SEC.patch → ...-new-log-level-SEC-for-audit-trails.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,42 +1,74 @@ | ||
| From da765b90bca45b91f72fd6525e680040eebd2d4b Mon Sep 17 00:00:00 2001 | ||
| From d128686fb15833e815ac3dd04bd87d3725c881ac Mon Sep 17 00:00:00 2001 | ||
| From: Joachim Wiberg <[email protected]> | ||
| Date: Wed, 21 Aug 2024 16:00:35 +0200 | ||
| Subject: [PATCH 7/9] Introduce new log level [SEC] | ||
| Subject: [PATCH 7/9] Introduce new log level [SEC] for audit trails | ||
| Organization: Addiva Elektronik | ||
|
|
||
| This adds a new log level for security and audit trail related log | ||
| messages. E.g., nacm user applied a change, copied a ds, etc. | ||
| messages, see LOG_AUDIT defined in RFC5424. E.g., nacm user applied | ||
| a change, copied a datastore, etc. | ||
|
|
||
| The new log level is added last to not affect the advertised command | ||
| line log levels. A security notice has higher actual priorty than | ||
| DBG, of course, so we remap it to WRN. The construct allows us to | ||
| have another [label] than [WRN], which might otherwise be read as | ||
| a bug/problem rather than just a high-priority-notification. | ||
|
|
||
| When logging to syslog() we let delegate labling and filtering to the | ||
| system log daemon, dropping any [SEVERITY] prefix. Also, \n is most | ||
| often dropped by log daemons. | ||
|
|
||
| Signed-off-by: Joachim Wiberg <[email protected]> | ||
| --- | ||
| src/log.c | 5 +++++ | ||
| src/log.h | 1 + | ||
| src/sysrepo_types.h | 3 ++- | ||
| tests/tcommon.c | 3 +++ | ||
| 4 files changed, 11 insertions(+), 1 deletion(-) | ||
| src/log.c | 18 +++++++++++++++++- | ||
| src/log.h | 1 + | ||
| src/sysrepo_types.h | 3 ++- | ||
| tests/tcommon.c | 3 +++ | ||
| 4 files changed, 23 insertions(+), 2 deletions(-) | ||
|
|
||
| diff --git a/src/log.c b/src/log.c | ||
| index e15055ac..b89ffacf 100644 | ||
| index e15055ac..25eab8fa 100644 | ||
| --- a/src/log.c | ||
| +++ b/src/log.c | ||
| @@ -122,6 +122,11 @@ sr_log_msg(int plugin, sr_log_level_t ll, const char *msg) | ||
| @@ -30,6 +30,10 @@ | ||
|
|
||
| #include "config.h" | ||
|
|
||
| +#ifndef LOG_AUDIT | ||
| +#define LOG_AUDIT (13<<3) /* Log audit, for audit trails */ | ||
| +#endif | ||
| + | ||
| sr_log_level_t sr_stderr_ll = SR_LL_NONE; /**< stderr log level */ | ||
| sr_log_level_t sr_syslog_ll = SR_LL_NONE; /**< syslog log level */ | ||
| int syslog_open; /**< Whether syslog was opened */ | ||
| @@ -122,6 +126,11 @@ sr_log_msg(int plugin, sr_log_level_t ll, const char *msg) | ||
| priority = LOG_INFO; | ||
| severity = "INF"; | ||
| break; | ||
| + case SR_LL_SEC: | ||
| + priority = LOG_WARNING; | ||
| + priority = LOG_AUDIT | LOG_NOTICE; | ||
| + severity = "SEC"; | ||
| + ll = SR_LL_WRN; /* remap to higher level. */ | ||
| + break; | ||
| case SR_LL_DBG: | ||
| priority = LOG_DEBUG; | ||
| severity = "DBG"; | ||
| @@ -138,7 +147,14 @@ sr_log_msg(int plugin, sr_log_level_t ll, const char *msg) | ||
|
|
||
| /* syslog logging */ | ||
| if (ll <= sr_syslog_ll) { | ||
| - syslog(priority | (plugin ? LOG_DAEMON : 0), "[%s] %s\n", severity, msg); | ||
| + int facility; | ||
| + | ||
| + if (priority & ~LOG_PRIMASK) | ||
| + facility = 0; /* audit */ | ||
| + else | ||
| + facility = plugin ? LOG_DAEMON : 0; | ||
| + | ||
| + syslog(facility | priority, "%s", msg); | ||
| } | ||
|
|
||
| /* logging callback */ | ||
| diff --git a/src/log.h b/src/log.h | ||
| index d7e65b88..8722e51d 100644 | ||
| --- a/src/log.h | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| From 7e49f394e0afedc0259d4364f5a9a83296fe2b72 Mon Sep 17 00:00:00 2001 | ||
| From b5db2b36c06d28918f0d00dda945f7e943b470af Mon Sep 17 00:00:00 2001 | ||
| From: Joachim Wiberg <[email protected]> | ||
| Date: Wed, 21 Aug 2024 16:04:43 +0200 | ||
| Subject: [PATCH 8/9] Add audit trail for high priority system changes | ||
|
|
@@ -18,7 +18,7 @@ Signed-off-by: Joachim Wiberg <[email protected]> | |
| 1 file changed, 12 insertions(+) | ||
|
|
||
| diff --git a/src/sysrepo.c b/src/sysrepo.c | ||
| index 86d694e5..c7b97e53 100644 | ||
| index 86d694e5..dcea51e8 100644 | ||
| --- a/src/sysrepo.c | ||
| +++ b/src/sysrepo.c | ||
| @@ -3946,6 +3946,9 @@ store: | ||
|
|
@@ -45,7 +45,7 @@ index 86d694e5..c7b97e53 100644 | |
| } | ||
| } | ||
|
|
||
| + if (session->nacm_user) | ||
| + if (session->nacm_user && src_datastore != SR_DS_CANDIDATE) | ||
| + SR_LOG_SEC("user \"%s\" copied %s to %s", session->nacm_user, sr_ds2str(src_datastore), sr_ds2str(session->ds)); | ||
| + | ||
| cleanup: | ||
|
|
||
2 changes: 1 addition & 1 deletion
2
patches/sysrepo/2.10.1/0009-On-error-in-sr_shmsub_listen_thread-exit-process.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| From 5c4df9f535f6fbdc6dc0573a47c47be2d02f1774 Mon Sep 17 00:00:00 2001 | ||
| From 13d54101eb2c3506237cebc5be99edef2ad669cd Mon Sep 17 00:00:00 2001 | ||
| From: Joachim Wiberg <[email protected]> | ||
| Date: Fri, 23 Aug 2024 12:22:06 +0200 | ||
| Subject: [PATCH 9/9] On error in sr_shmsub_listen_thread(), exit process | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters