Most commands are entered one line at a time and processed as complete lines in non-canonical mode. Commands that interactively require a password, enter canonical mode to do this while shutting off echo. This pair of features (icanon and !echo) can be used to avoid logging passwords by audit while still logging the rest of the command. Adding a member (log_passwd) to the struct audit_tty_status passed in by pam_tty_audit allows control of canonical mode without echo per task.
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -369,7 +369,8 @@ struct audit_status { · 368 unmodified lines | |||
| 369 | }; | 369 | }; |
| 370 | 370 | ||
| 371 | struct audit_tty_status { | 371 | struct audit_tty_status { |
| 372 | __u32 enabled; /* 1 = enabled, 0 = disabled */ | 372 | __u32 enabled; /* 1 = enabled, 0 = disabled */ |
| 373 | __u32 log_passwd; /* 1 = enabled, 0 = disabled */ | ||
| 373 | }; | 374 | }; |
| 374 | 375 | ||
| 375 | /* audit_rule_data supports filter rules with both integer and string | 376 | /* audit_rule_data supports filter rules with both integer and string |