audit: improve the audit messages we generate

[elogind.git] / src / update-utmp / update-utmp.c

diff --git a/src/update-utmp/update-utmp.c b/src/update-utmp/update-utmp.c
index a62c538ecd65ffbda89ba7c1cef6b23eb27ffe6f..311d686a8cc3e654cca5271985ba5eea355909ce 100644 (file)
--- a/src/update-utmp/update-utmp.c
+++ b/src/update-utmp/update-utmp.c
@@ -38,6 +38,7 @@
 #include "utmp-wtmp.h"
 #include "bus-util.h"
 #include "bus-error.h"
+#include "unit-name.h"
 
 typedef struct Context {
         sd_bus *bus;
@@ -93,27 +94,11 @@ static int get_current_runlevel(Context *c) {
         assert(c);
 
         for (i = 0; i < ELEMENTSOF(table); i++) {
-                _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
-                _cleanup_free_ char *state = NULL;
-                const char *path = NULL;
+                _cleanup_free_ char *state = NULL, *path = NULL;
 
-                r = sd_bus_call_method(
-                                c->bus,
-                                "org.freedesktop.systemd1",
-                                "/org/freedesktop/systemd1",
-                                "org.freedesktop.systemd1.Manager",
-                                "LoadUnit",
-                                &error,
-                                &reply,
-                                "s", table[i].special);
-                if (r < 0) {
-                        log_warning("Failed to get runlevel: %s", bus_error_message(&error, -r));
-                        continue;
-                }
-
-                r = sd_bus_message_read(reply, "o", &path);
-                if (r < 0)
-                        return bus_log_parse_error(r);
+                path = unit_dbus_path_from_name(table[i].special);
+                if (!path)
+                        return log_oom();
 
                 r = sd_bus_get_property_string(
                                 c->bus,
@@ -146,7 +131,7 @@ static int on_reboot(Context *c) {
 
 #ifdef HAVE_AUDIT
         if (c->audit_fd >= 0)
-                if (audit_log_user_message(c->audit_fd, AUDIT_SYSTEM_BOOT, "init", NULL, NULL, NULL, 1) < 0 &&
+                if (audit_log_user_comm_message(c->audit_fd, AUDIT_SYSTEM_BOOT, "", "systemd-update-utmp", NULL, NULL, NULL, 1) < 0 &&
                     errno != EPERM) {
                         log_error("Failed to send audit message: %m");
                         r = -errno;
@@ -157,7 +142,8 @@ static int on_reboot(Context *c) {
          * utmp_put_reboot() will then fix to the current time */
         t = get_startup_time(c);
 
-        if ((q = utmp_put_reboot(t)) < 0) {
+        q = utmp_put_reboot(t);
+        if (q < 0) {
                 log_error("Failed to write utmp record: %s", strerror(-q));
                 r = q;
         }
@@ -175,14 +161,15 @@ static int on_shutdown(Context *c) {
 
 #ifdef HAVE_AUDIT
         if (c->audit_fd >= 0)
-                if (audit_log_user_message(c->audit_fd, AUDIT_SYSTEM_SHUTDOWN, "init", NULL, NULL, NULL, 1) < 0 &&
+                if (audit_log_user_comm_message(c->audit_fd, AUDIT_SYSTEM_SHUTDOWN, "", "systemd-update-utmp", NULL, NULL, NULL, 1) < 0 &&
                     errno != EPERM) {
                         log_error("Failed to send audit message: %m");
                         r = -errno;
                 }
 #endif
 
-        if ((q = utmp_put_shutdown()) < 0) {
+        q = utmp_put_shutdown();
+        if (q < 0) {
                 log_error("Failed to write utmp record: %s", strerror(-q));
                 r = q;
         }
@@ -199,21 +186,21 @@ static int on_runlevel(Context *c) {
          * utmp record and send the audit msg */
 
         /* First, get last runlevel */
-        if ((q = utmp_get_runlevel(&previous, NULL)) < 0) {
+        q = utmp_get_runlevel(&previous, NULL);
 
+        if (q < 0) {
                 if (q != -ESRCH && q != -ENOENT) {
                         log_error("Failed to get current runlevel: %s", strerror(-q));
                         return q;
                 }
 
-                /* Hmm, we didn't find any runlevel, that means we
-                 * have been rebooted */
-                r = on_reboot(c);
                 previous = 0;
         }
 
         /* Secondly, get new runlevel */
-        if ((runlevel = get_current_runlevel(c)) < 0)
+        runlevel = get_current_runlevel(c);
+
+        if (runlevel < 0)
                 return runlevel;
 
         if (previous == runlevel)
@@ -221,40 +208,37 @@ static int on_runlevel(Context *c) {
 
 #ifdef HAVE_AUDIT
         if (c->audit_fd >= 0) {
-                char *s = NULL;
+                _cleanup_free_ char *s = NULL;
 
                 if (asprintf(&s, "old-level=%c new-level=%c",
                              previous > 0 ? previous : 'N',
                              runlevel > 0 ? runlevel : 'N') < 0)
-                        return -ENOMEM;
+                        return log_oom();
 
-                if (audit_log_user_message(c->audit_fd, AUDIT_SYSTEM_RUNLEVEL, s, NULL, NULL, NULL, 1) < 0 &&
+                if (audit_log_user_comm_message(c->audit_fd, AUDIT_SYSTEM_RUNLEVEL, s, "systemd-update-utmp", NULL, NULL, NULL, 1) < 0 &&
                     errno != EPERM) {
                         log_error("Failed to send audit message: %m");
                         r = -errno;
                 }
-
-                free(s);
         }
 #endif
 
-        if ((q = utmp_put_runlevel(runlevel, previous)) < 0) {
-                if (q != -ESRCH && q != -ENOENT) {
-                        log_error("Failed to write utmp record: %s", strerror(-q));
-                        r = q;
-                }
+        q = utmp_put_runlevel(runlevel, previous);
+        if (q < 0 && q != -ESRCH && q != -ENOENT) {
+                log_error("Failed to write utmp record: %s", strerror(-q));
+                r = q;
         }
 
         return r;
 }
 
 int main(int argc, char *argv[]) {
-        int r;
-        Context c = {};
-
+        Context c = {
 #ifdef HAVE_AUDIT
-        c.audit_fd = -1;
+                .audit_fd = -1
 #endif
+        };
+        int r;
 
         if (getppid() != 1) {
                 log_error("This program should be invoked by init only.");
@@ -273,10 +257,10 @@ int main(int argc, char *argv[]) {
         umask(0022);
 
 #ifdef HAVE_AUDIT
-        if ((c.audit_fd = audit_open()) < 0 &&
-            /* If the kernel lacks netlink or audit support,
-             * don't worry about it. */
-            errno != EAFNOSUPPORT && errno != EPROTONOSUPPORT)
+        /* If the kernel lacks netlink or audit support,
+         * don't worry about it. */
+        c.audit_fd = audit_open();
+        if (c.audit_fd < 0 && errno != EAFNOSUPPORT && errno != EPROTONOSUPPORT)
                 log_error("Failed to connect to audit log: %m");
 #endif
         r = bus_open_system_systemd(&c.bus);
@@ -286,7 +270,7 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        log_debug("systemd-update-utmp running as pid %lu", (unsigned long) getpid());
+        log_debug("systemd-update-utmp running as pid "PID_FMT, getpid());
 
         if (streq(argv[1], "reboot"))
                 r = on_reboot(&c);
@@ -299,7 +283,7 @@ int main(int argc, char *argv[]) {
                 r = -EINVAL;
         }
 
-        log_debug("systemd-update-utmp stopped as pid %lu", (unsigned long) getpid());
+        log_debug("systemd-update-utmp stopped as pid "PID_FMT, getpid());
 
 finish:
 #ifdef HAVE_AUDIT