libuser/0003-Add-audit-events-around-user-life-cycle.patch

From 72962208c42ea202f1e31f2f3ac1b523cd545b06 Mon Sep 17 00:00:00 2001
From: Steve Grubb <sgrubb@redhat.com>
Date: Fri, 3 Aug 2018 11:33:05 +0200
Subject: [PATCH] Add audit events around user life cycle

---
 Makefile.am        | 18 ++++++-------
 apps/lchage.c      |  5 ++++
 apps/lchsh.c       |  7 +++++
 apps/lgroupadd.c   |  5 ++++
 apps/lgroupdel.c   |  6 +++++
 apps/lgroupmod.c   | 36 +++++++++++++++++++++++++
 apps/luseradd.c    | 16 +++++++++++
 apps/luserdel.c    | 17 ++++++++++++
 apps/lusermod.c    | 38 +++++++++++++++++++++++++-
 configure.ac       | 17 ++++++++++++
 lib/common.c       | 66 +++++++++++++++++++++++++++++++++++++++++++++-
 lib/user_private.h | 15 +++++++++++
 12 files changed, 235 insertions(+), 11 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 080f97e8cc81a77dd0413c3b6fe7fe8002499393..9f099bd71941a869274a502a3130802731d83c24 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -116,7 +116,7 @@ apps_libapputil_la_LDFLAGS = $(GOBJECT_LIBS) -lpam -lpam_misc $(SELINUX_LIBS)
 
 apps_lchage_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lchage_LDADD = lib/libuser.la $(LTLIBINTL)
-apps_lchage_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_lchage_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 apps_lchfn_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lchfn_LDADD = apps/libapputil.la lib/libuser.la $(LTLIBINTL)
@@ -124,19 +124,19 @@ apps_lchfn_LDFLAGS = $(GMODULE_LIBS) -lpopt
 
 apps_lchsh_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lchsh_LDADD = apps/libapputil.la lib/libuser.la $(LTLIBINTL)
-apps_lchsh_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_lchsh_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 apps_lgroupadd_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lgroupadd_LDADD = lib/libuser.la $(LTLIBINTL)
-apps_lgroupadd_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_lgroupadd_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 apps_lgroupdel_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lgroupdel_LDADD = lib/libuser.la $(LTLIBINTL)
-apps_lgroupdel_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_lgroupdel_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 apps_lgroupmod_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lgroupmod_LDADD = lib/libuser.la $(LTLIBINTL)
-apps_lgroupmod_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_lgroupmod_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 apps_lid_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lid_LDADD = lib/libuser.la $(LTLIBINTL)
@@ -152,15 +152,15 @@ apps_lpasswd_LDFLAGS = $(GMODULE_LIBS) -lpopt
 
 apps_luseradd_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_luseradd_LDADD = lib/libuser.la $(LTLIBINTL)
-apps_luseradd_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_luseradd_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 apps_luserdel_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_luserdel_LDADD = lib/libuser.la $(LTLIBINTL)
-apps_luserdel_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_luserdel_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 apps_lusermod_CPPFLAGS = $(AM_CPPFLAGS) $(LOCALEDIR_CPPFLAGS)
 apps_lusermod_LDADD = lib/libuser.la $(LTLIBINTL)
-apps_lusermod_LDFLAGS = $(GMODULE_LIBS) -lpopt
+apps_lusermod_LDFLAGS = $(GMODULE_LIBS) -lpopt $(AUDIT_LIBS)
 
 lib_libuser_la_SOURCES = lib/common.c lib/config.c lib/entity.c lib/error.c \
 	lib/fs.c lib/getdate.y lib/internal.h lib/misc.c lib/modules.c \
@@ -170,7 +170,7 @@ lib_libuser_la_CPPFLAGS = $(GMODULE_CFLAGS) -Ilib $(LOCALEDIR_CPPFLAGS) \
 	-DMODULEDIR='"$(pkglibdir)"' -DNSCD='"$(NSCD)"' \
 	-DSYSCONFDIR='"$(sysconfdir)"'
 lib_libuser_la_LDFLAGS = $(GMODULE_LIBS) $(CRYPT_LIBS) $(SELINUX_LIBS) \
-	-version-info 6:2:5
+	$(AUDIT_LIBS) -version-info 6:2:5
 lib_libuser_la_LIBADD = $(LTLIBINTL)
 
 modules_libuser_files_la_SOURCES = modules/files.c
diff --git a/apps/lchage.c b/apps/lchage.c
index bad296ccf0755dd6781b1a2e6397dccb1f7dbd12..1a4f04883062cb11f15a2e34d37e127fef2a374e 100644
--- a/apps/lchage.c
+++ b/apps/lchage.c
@@ -29,6 +29,7 @@
 #include <popt.h>
 #include <glib.h>
 #include "../lib/user.h"
+#include "../lib/user_private.h"
 #include "apputil.h"
 
 #define INVALID_LONG LONG_MIN
@@ -239,8 +240,12 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("Failed to modify aging information for %s: "
 				  "%s\n"), user, lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_MGMT, "change-age", user,
+				AUDIT_NO_ID, 0);
 			return 3;
 		}
+		lu_audit_logger(AUDIT_USER_MGMT, "change-age", user,
+				AUDIT_NO_ID, 1);
 
 		lu_nscd_flush_cache(LU_NSCD_CACHE_PASSWD);
 	}
diff --git a/apps/lchsh.c b/apps/lchsh.c
index 7c8a9246d4548a7f6fbacce91cdfdf4372799943..555ed2ea7b0d5a90bf37a7f23c398b382ac45a38 100644
--- a/apps/lchsh.c
+++ b/apps/lchsh.c
@@ -26,6 +26,7 @@
 #include <string.h>
 #include <unistd.h>
 #include "../lib/user.h"
+#include "../lib/user_private.h"
 #include "apputil.h"
 
 int
@@ -120,6 +121,8 @@ main(int argc, const char **argv)
 				      NULL, &error) == FALSE) {
 			fprintf(stderr, _("Shell not changed: %s\n"),
 				lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_MGMT, "change-shell", user,
+				AUDIT_NO_ID, 0);
 			return 1;
 		}
 		/* Modify the in-memory structure's shell attribute. */
@@ -132,9 +135,13 @@ main(int argc, const char **argv)
 		if (lu_user_modify(ctx, ent, &error)) {
 			g_print(_("Shell changed.\n"));
 			lu_nscd_flush_cache(LU_NSCD_CACHE_PASSWD);
+			lu_audit_logger(AUDIT_USER_MGMT, "change-shell", user,
+				AUDIT_NO_ID, 1);
 		} else {
 			fprintf(stderr, _("Shell not changed: %s\n"),
 				lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_MGMT, "change-shell", user,
+				AUDIT_NO_ID, 0);
 			return 1;
 		}
 	}
diff --git a/apps/lgroupadd.c b/apps/lgroupadd.c
index d73ee864adac9e5dbc7d98392190db225d116143..3fa2a1df5ac5838ef256541c07ae6028e4f6a80b 100644
--- a/apps/lgroupadd.c
+++ b/apps/lgroupadd.c
@@ -118,6 +118,8 @@ main(int argc, const char **argv)
 	if (lu_group_add(ctx, ent, &error) == FALSE) {
 		fprintf(stderr, _("Group creation failed: %s\n"),
 			lu_strerror(error));
+		lu_audit_logger(AUDIT_ADD_GROUP, "add-group", name,
+				AUDIT_NO_ID, 0);
 		return 2;
 	}
 
@@ -127,5 +129,8 @@ main(int argc, const char **argv)
 
 	lu_end(ctx);
 
+	lu_audit_logger(AUDIT_ADD_GROUP, "add-group", name,
+				AUDIT_NO_ID, 1);
+
 	return 0;
 }
diff --git a/apps/lgroupdel.c b/apps/lgroupdel.c
index e0fd6c6d42f55eef82f0790f551721972c129b5f..c5ccbed95cb834719cd109a81e6f979bb737dc71 100644
--- a/apps/lgroupdel.c
+++ b/apps/lgroupdel.c
@@ -24,6 +24,7 @@
 #include <locale.h>
 #include <popt.h>
 #include "../lib/user.h"
+#include "../lib/user_private.h"
 #include "apputil.h"
 
 int
@@ -90,6 +91,8 @@ main(int argc, const char **argv)
 	if (lu_group_delete(ctx, ent, &error) == FALSE) {
 		fprintf(stderr, _("Group %s could not be deleted: %s\n"),
 			group, lu_strerror(error));
+		lu_audit_logger(AUDIT_DEL_GROUP, "delete-group", group,
+				AUDIT_NO_ID, 0);
 		return 3;
 	}
 
@@ -99,5 +102,8 @@ main(int argc, const char **argv)
 
 	lu_end(ctx);
 
+	lu_audit_logger(AUDIT_DEL_GROUP, "delete-group", group,
+			AUDIT_NO_ID, 1);
+
 	return 0;
 }
diff --git a/apps/lgroupmod.c b/apps/lgroupmod.c
index 21170e06f37370d7b2f2d936048ae7abf24fd181..0ad0ae4f39d32435b4668ef15ec678d8ea319e5c 100644
--- a/apps/lgroupmod.c
+++ b/apps/lgroupmod.c
@@ -138,8 +138,14 @@ main(int argc, const char **argv)
 		    == FALSE) {
 			fprintf(stderr, _("Failed to set password for group "
 				"%s: %s\n"), group, lu_strerror(error));
+			lu_audit_logger(AUDIT_GRP_MGMT,
+					"changing-group-passwd", group,
+					AUDIT_NO_ID, 0);
 			return 4;
 		}
+		lu_audit_logger(AUDIT_GRP_MGMT,
+				"changing-group-passwd", group,
+				AUDIT_NO_ID, 1);
 	}
 
 	if (cryptedUserPassword) {
@@ -147,8 +153,14 @@ main(int argc, const char **argv)
 				     &error) == FALSE) {
 			fprintf(stderr, _("Failed to set password for group "
 				"%s: %s\n"), group, lu_strerror(error));
+			lu_audit_logger(AUDIT_GRP_MGMT,
+					"changing-group-passwd", group,
+					AUDIT_NO_ID, 0);
 			return 5;
 		}
+		lu_audit_logger(AUDIT_GRP_MGMT,
+				"changing-group-passwd", group,
+				AUDIT_NO_ID, 1);
 	}
 
 	if (lock) {
@@ -156,8 +168,14 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("Group %s could not be locked: %s\n"), group,
 				lu_strerror(error));
+			lu_audit_logger(AUDIT_GRP_MGMT,
+					"changing-group-lock", group,
+					AUDIT_NO_ID, 0);
 			return 6;
 		}
+		lu_audit_logger(AUDIT_GRP_MGMT,
+				"changing-group-lock", group,
+				AUDIT_NO_ID, 1);
 	}
 
 	if (unlock) {
@@ -165,8 +183,14 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("Group %s could not be unlocked: %s\n"),
 				group, lu_strerror(error));
+			lu_audit_logger(AUDIT_GRP_MGMT,
+					"changing-group-lock", group,
+					AUDIT_NO_ID, 0);
 			return 7;
 		}
+		lu_audit_logger(AUDIT_GRP_MGMT,
+				"changing-group-lock", group,
+				AUDIT_NO_ID, 1);
 	}
 
 	change = gid || addAdmins || remAdmins || addMembers || remMembers;
@@ -241,8 +265,14 @@ main(int argc, const char **argv)
 	if (change && lu_group_modify(ctx, ent, &error) == FALSE) {
 		fprintf(stderr, _("Group %s could not be modified: %s\n"),
 			group, lu_strerror(error));
+		lu_audit_logger(AUDIT_GRP_MGMT,
+				"changing-group-members", group,
+				AUDIT_NO_ID, 0);
 		return 8;
 	}
+	lu_audit_logger(AUDIT_GRP_MGMT,
+			"changing-group-members", group,
+			AUDIT_NO_ID, 1);
 	if (gidNumber != LU_VALUE_INVALID_ID) {
 		users = lu_users_enumerate_by_group_full(ctx, gid, &error);
 
@@ -256,8 +286,14 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("Group %s could not be modified: %s\n"),
 				group, lu_strerror(error));
+			lu_audit_logger(AUDIT_GRP_MGMT,
+				"changing-group-id", group,
+				AUDIT_NO_ID, 0);
 			return 8;
 		}
+		lu_audit_logger(AUDIT_GRP_MGMT,
+			"changing-group-id", group,
+			AUDIT_NO_ID, 1);
 	}
 
 	lu_ent_free(ent);
diff --git a/apps/luseradd.c b/apps/luseradd.c
index 7839183c00f892ad50f77f5aed6ada07cd3c125b..9d7f4f10a9c6f849e551f017f05c2e67e4a56259 100644
--- a/apps/luseradd.c
+++ b/apps/luseradd.c
@@ -210,8 +210,12 @@ main(int argc, const char **argv)
 				lu_error_free(&error);
 			}
 			lu_end(ctx);
+			lu_audit_logger(AUDIT_ADD_GROUP, "add-group", name,
+					AUDIT_NO_ID, 0);
 			return 1;
 		}
+		lu_audit_logger(AUDIT_ADD_GROUP, "add-group", name,
+				AUDIT_NO_ID, 1);
 	}
 
 	/* Retrieve the group ID. */
@@ -259,9 +263,13 @@ main(int argc, const char **argv)
 	if (lu_user_add(ctx, ent, &error) == FALSE) {
 		fprintf(stderr, _("Account creation failed: %s.\n"),
 			lu_strerror(error));
+		lu_audit_logger(AUDIT_ADD_USER, "add-user", name,
+					AUDIT_NO_ID, 0);
+
 		return 3;
 	}
         lu_nscd_flush_cache(LU_NSCD_CACHE_PASSWD);
+	lu_audit_logger(AUDIT_ADD_USER, "add-user", name, AUDIT_NO_ID, 1);
 
 	/* If we don't have the the don't-create-home flag, create the user's
 	 * home directory. */
@@ -282,8 +290,12 @@ main(int argc, const char **argv)
 					&error) == FALSE) {
 			fprintf(stderr, _("Error creating %s: %s.\n"),
 				homeDirectory, lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_MGMT, "add-home-dir", name,
+				uidNumber, 0);
 			return 7;
 		}
+		lu_audit_logger(AUDIT_USER_MGMT, "add-home-dir", name,
+				uidNumber, 1);
 
 		/* Create a mail spool for the user. */
 		if (lu_mail_spool_create(ctx, ent, &error) != TRUE) {
@@ -311,8 +323,12 @@ main(int argc, const char **argv)
 			fprintf(stderr, _("Error setting password for user "
 					  "%s: %s.\n"), name,
 				lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_CHAUTHTOK, "updating-password",
+					name, uidNumber, 0);
 			return 3;
 		}
+		lu_audit_logger(AUDIT_USER_CHAUTHTOK, "updating-password",
+					name, uidNumber, 1);
 	}
 	lu_nscd_flush_cache(LU_NSCD_CACHE_PASSWD);
 
diff --git a/apps/luserdel.c b/apps/luserdel.c
index 2f39a4ffb8ae47ac5dc3c84270b54a8ca68c7403..7e20fa7ea9bf4082967bc6931a8557936bfda0a2 100644
--- a/apps/luserdel.c
+++ b/apps/luserdel.c
@@ -26,6 +26,7 @@
 #include <string.h>
 #include <unistd.h>
 #include "../lib/user.h"
+#include "../lib/user_private.h"
 #include "apputil.h"
 
 int
@@ -93,8 +94,12 @@ main(int argc, const char **argv)
 	if (lu_user_delete(ctx, ent, &error) == FALSE) {
 		fprintf(stderr, _("User %s could not be deleted: %s.\n"),
 			user, lu_strerror(error));
+		lu_audit_logger(AUDIT_DEL_USER, "delete-user", user,
+				AUDIT_NO_ID, 0);
 		return 3;
 	}
+	lu_audit_logger(AUDIT_DEL_USER, "delete-user", user,
+			AUDIT_NO_ID, 1);
 
 	lu_nscd_flush_cache(LU_NSCD_CACHE_PASSWD);
 
@@ -126,9 +131,15 @@ main(int argc, const char **argv)
 				fprintf(stderr, _("Group %s could not be "
 						  "deleted: %s.\n"), tmp,
 					lu_strerror(error));
+				lu_audit_logger_with_group (AUDIT_DEL_GROUP,
+					"delete-group", user, AUDIT_NO_ID,
+					tmp, 0);
 				return 7;
 			}
 		}
+		lu_audit_logger_with_group (AUDIT_DEL_GROUP,
+					    "delete-group", user,
+					    AUDIT_NO_ID, tmp, 1);
 		lu_ent_free(group_ent);
 		lu_nscd_flush_cache(LU_NSCD_CACHE_GROUP);
 	}
@@ -138,8 +149,14 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("Error removing home directory: %s.\n"),
 				lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_MGMT,
+					"deleting-home-directory", user,
+					AUDIT_NO_ID, 0);
 			return 9;
 		}
+		lu_audit_logger(AUDIT_USER_MGMT, "deleting-home-directory", user,
+				AUDIT_NO_ID, 1);
+
 		/* Delete the user's mail spool. */
 		if (lu_mail_spool_remove(ctx, ent, &error) != TRUE) {
 			fprintf(stderr, _("Error removing mail spool: %s"),
diff --git a/apps/lusermod.c b/apps/lusermod.c
index afec147475736f0b814b5e1f30c77064f3915c20..143157f114c93960fb879d9e6e0c1fb914f3ffcb 100644
--- a/apps/lusermod.c
+++ b/apps/lusermod.c
@@ -179,8 +179,13 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("Failed to set password for user %s: %s.\n"),
 				user, lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_CHAUTHTOK, 
+					"updating-password", user,
+					uidNumber, 0);
 			return 5;
 		}
+		lu_audit_logger(AUDIT_USER_CHAUTHTOK, "updating-password",
+				user, uidNumber, 0);
 	}
 
 	/* If we need to change a user's crypted password, try to change it,
@@ -192,8 +197,13 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("Failed to set password for user %s: %s.\n"),
 				user, lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_CHAUTHTOK, 
+					"updating-password", user,
+					uidNumber, 0);
 			return 6;
 		}
+		lu_audit_logger(AUDIT_USER_CHAUTHTOK, "updating-password",
+				user, uidNumber, 0);
 	}
 
 	/* If we need to lock/unlock the user's account, do that. */
@@ -202,16 +212,26 @@ main(int argc, const char **argv)
 			fprintf(stderr,
 				_("User %s could not be locked: %s.\n"),
 				user, lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_CHAUTHTOK, 
+					"locking-account", user,
+					uidNumber, 0);
 			return 7;
 		}
+		lu_audit_logger(AUDIT_USER_CHAUTHTOK, "locking-account",
+				user, uidNumber, 0);
 	}
 	if (unlock) {
 		if (lu_user_unlock(ctx, ent, &error) == FALSE) {
 			fprintf(stderr,
 				_("User %s could not be unlocked: %s.\n"),
 				user, lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_CHAUTHTOK, 
+					"unlocking-account", user,
+					uidNumber, 0);
 			return 8;
 		}
+		lu_audit_logger(AUDIT_USER_CHAUTHTOK, "unlocking-account",
+				user, uidNumber, 0);
 	}
 
 	/* Determine if we actually need to change anything. */
@@ -274,8 +294,13 @@ main(int argc, const char **argv)
 	if (change && (lu_user_modify(ctx, ent, &error) == FALSE)) {
 		fprintf(stderr, _("User %s could not be modified: %s.\n"),
 			user, lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_MGMT, 
+					"modify-account", user,
+					uidNumber, 0);
 		return 9;
 	}
+	lu_audit_logger(AUDIT_USER_MGMT, "modify-account",
+			user, uidNumber, 1);
 	lu_nscd_flush_cache(LU_NSCD_CACHE_PASSWD);
 
 	/* If the user's name changed, we need to update supplemental
@@ -322,12 +347,19 @@ main(int argc, const char **argv)
 				}
 			}
 			/* Save the changes to the group. */
-			if (lu_group_modify(ctx, group, &error) == FALSE)
+			if (lu_group_modify(ctx, group, &error) == FALSE) {
 				fprintf(stderr, _("Group %s could not be "
 						  "modified: %s.\n"),
 					lu_ent_get_first_string(group,
 								LU_GROUPNAME),
 					lu_strerror(error));
+				lu_audit_logger_with_group(AUDIT_USER_MGMT, 
+						    "update-member-in-group", user, uidNumber,
+						    lu_ent_get_first_string(group, LU_GROUPNAME),0);
+			} else
+				lu_audit_logger_with_group(AUDIT_USER_MGMT, 
+						    "update-member-in-group", user, uidNumber,
+						    lu_ent_get_first_string(group, LU_GROUPNAME),1);
 			lu_ent_free(group);
 		}
 		g_ptr_array_free(groups, TRUE);
@@ -353,8 +385,12 @@ main(int argc, const char **argv)
 			fprintf(stderr, _("Error moving %s to %s: %s.\n"),
 				oldHomeDirectory, homeDirectory,
 				lu_strerror(error));
+			lu_audit_logger(AUDIT_USER_MGMT, "moving-home-dir",
+					user, uidNumber, 0);
 			return 12;
 		}
+		lu_audit_logger(AUDIT_USER_MGMT, "moving-home-dir",
+				user, uidNumber, 1);
 	}
 	g_free(oldHomeDirectory);
 
diff --git a/configure.ac b/configure.ac
index 3e68b16a1f65ff5e5e3e905c1ffce8993e562176..0bd4a67d4c77fa1b701d74dbeab908a192dbf4d7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -118,6 +118,23 @@ if test "x$selinux" != xno ; then
 fi
 AC_SUBST(SELINUX_LIBS)
 
+AC_ARG_WITH(audit,
+AS_HELP_STRING([--with-audit],[log using Linux Audit in addition to syslog]),
+use_audit=$withval,
+use_audit=auto)
+if test x$use_audit != xno ; then
+        AC_SEARCH_LIBS([audit_open], [audit])
+        if test x$ac_cv_search_audit_open = xno ; then
+                if test x$use_audit != xauto ; then
+                        AC_MSG_ERROR([requested Linux Audit, but libaudit was not found])
+                fi
+        else
+                AC_DEFINE(WITH_AUDIT,1,[Define if you want to use Linux Audit.])
+		AUDIT_LIBS=-laudit
+        fi
+fi
+AC_SUBST(AUDIT_LIBS)
+
 AC_C_CONST
 AC_TYPE_UID_T
 AC_TYPE_MODE_T
diff --git a/lib/common.c b/lib/common.c
index fc5df7461111908ff3eae59608ce0a51d62e155e..dce7e570ec9c92b56b28f15ab503fb7a641b660e 100644
--- a/lib/common.c
+++ b/lib/common.c
@@ -16,9 +16,10 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
  */
 
-#include <config.h>
+#include "config.h"
 #include <glib.h>
 #include <string.h>
+#include <stdlib.h>
 
 #include "internal.h"
 #include "user_private.h"
@@ -111,3 +112,66 @@ lu_common_sgroup_default(struct lu_module *module,
 	g_return_val_if_fail(name != NULL, FALSE);
 	return lu_common_group_default(module, name, is_system, ent, error);
 }
+
+#ifdef WITH_AUDIT
+static int audit_fd = 0;
+
+/* result - 1 is "success" and 0 is "failed" */
+void lu_audit_logger(int type, const char *op, const char *name,
+                        unsigned int id, unsigned int result)
+{
+	if (audit_fd == 0) {
+		/* First time through */
+		audit_fd = audit_open();
+		if (audit_fd < 0) {
+			/* You get these only when the kernel doesn't have
+			 * audit compiled in. */
+			if (	   (errno == EINVAL)
+				|| (errno == EPROTONOSUPPORT)
+				|| (errno == EAFNOSUPPORT))
+					return;
+			fputs("Cannot open audit interface - aborting.\n", stderr);
+			exit(EXIT_FAILURE);
+		}
+	}
+	if (audit_fd < 0)
+		return;
+	audit_log_acct_message(audit_fd, type, NULL, op, name, id,
+		NULL, NULL, NULL, (int) result);
+}
+
+/* result - 1 is "success" and 0 is "failed" */
+void lu_audit_logger_with_group (int type, const char *op, const char *name,
+		unsigned int id, const char *grp, unsigned int result)
+{
+	int len;
+	char enc_group[(LOGIN_NAME_MAX*2)+1], buf[1024];
+
+	if (audit_fd == 0) {
+		/* First time through */
+		audit_fd = audit_open();
+		if (audit_fd < 0) {
+			/* You get these only when the kernel doesn't have
+			 * audit compiled in. */
+			if (	   (errno == EINVAL)
+				|| (errno == EPROTONOSUPPORT)
+				|| (errno == EAFNOSUPPORT))
+					return;
+			fputs("Cannot open audit interface - aborting.\n", stderr);
+			exit(EXIT_FAILURE);
+		}
+	}
+	if (audit_fd < 0)
+		return;
+	len = strnlen(grp, sizeof(enc_group)/2);
+	if (audit_value_needs_encoding(grp, len)) {
+		snprintf(buf, sizeof(buf), "%s grp=%s", op,
+			audit_encode_value(enc_group, grp, len));
+	} else {
+		snprintf(buf, sizeof(buf), "%s grp=\"%s\"", op, grp);
+	}
+	audit_log_acct_message(audit_fd, type, NULL, buf, name, id,
+			NULL, NULL, NULL, (int) result);
+}
+#endif
+
diff --git a/lib/user_private.h b/lib/user_private.h
index a4869c138d51519539b6939406cdb0fee23ab7f6..02b813c47ee359db774bb85a2aa7aa12e18d3067 100644
--- a/lib/user_private.h
+++ b/lib/user_private.h
@@ -34,6 +34,9 @@
 #ifdef WITH_SELINUX
 #include <selinux/selinux.h>
 #endif
+#ifdef WITH_AUDIT
+#include <libaudit.h>
+#endif
 #include "user.h"
 
 G_BEGIN_DECLS
@@ -357,6 +360,18 @@ id_t lu_get_first_unused_id(struct lu_context *ctx, enum lu_entity_type type,
 /* Append a copy of VALUES to DEST */
 void lu_util_append_values(GValueArray *dest, GValueArray *values);
 
+#ifdef WITH_AUDIT
+void lu_audit_logger(int type, const char *op, const char *name,
+		     unsigned int id, unsigned int result);
+void lu_audit_logger_with_group(int type, const char *op, const char *name,
+				 unsigned int id, const char *grp,
+				 unsigned int result);
+#else
+#define lu_audit_logger(a, b, c, d, e)
+#define lu_audit_logger_with_group(a, b, c, d, e, f)
+#endif
+#define AUDIT_NO_ID	((unsigned int) -1)
+
 G_END_DECLS
 
 #endif
-- 
2.17.1