1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
/*
* auditd.c
*
* This is a simple audit daemon that throws all messages away.
*
* Peter Jones <pjones@redhat.com>
*
* Copyright 2006 Red Hat, Inc.
*
* This software may be freely redistributed under the terms of the GNU
* General Public License, version 2.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#define _GNU_SOURCE 1
#include <sys/types.h>
#include <sys/syscall.h>
#include <sys/poll.h>
#include <unistd.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <libaudit.h>
#include "auditd.h"
#ifdef USESELINUX
static int done;
static void sig_done(int sig)
{
done = 1;
}
static void do_auditd(int fd) {
struct audit_reply rep;
sigset_t sigs;
struct sigaction sa;
struct pollfd pds = {
.events = POLLIN | POLLPRI | POLLERR | POLLHUP | POLLMSG,
.revents = 0,
.fd = fd,
};
if (audit_set_pid(fd, getpid(), WAIT_YES) < 0)
return;
if (audit_set_enabled(fd, 1) < 0)
return;
memset(&sa, '\0', sizeof (sa));
sa.sa_handler = sig_done;
sigaction(SIGTERM, &sa, NULL);
sigaction(SIGINT, &sa, NULL);
sigaction(SIGHUP, &sa, NULL);
sigfillset(&sigs);
sigdelset(&sigs, SIGTERM);
sigdelset(&sigs, SIGINT);
sigdelset(&sigs, SIGHUP);
while (1) {
struct timespec timeout = { -1, -1 };
int retval;
memset(&rep, 0, sizeof(rep));
do {
retval = ppoll(&pds, 1, &timeout, &sigs);
} while (retval == -1 && errno == EINTR && !done);
if (done)
break;
if (audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING, 0) > 0) {
/* we don't actually want to do anything here. */
;
}
}
return;
}
#endif /* USESELINUX */
int audit_daemonize(void) {
#ifdef USESELINUX
int fd;
#ifndef STANDALONE
int i;
pid_t child;
if ((child = fork()) > 0)
return 0;
for (i = 0; i < getdtablesize(); i++)
close(i);
signal(SIGTTOU, SIG_IGN);
signal(SIGTTIN, SIG_IGN);
signal(SIGTSTP, SIG_IGN);
if ((fd = open("/proc/self/oom_adj", O_RDWR)) >= 0) {
i = write(fd, "-17", 3);
close(fd);
}
#endif /* !defined(STANDALONE) */
fd = audit_open();
do_auditd(fd);
audit_close(fd);
#endif /* USESELINUX */
exit(0);
}
#ifdef STANDALONE
int main(void) {
return audit_daemonize();
}
#endif /* STANDALONE */
/*
* vim:ts=8:sw=4:sts=4:et
*/
|
