Revision

23925

Author

dsorresso@apple.com

Date

2009-06-16 12:30:19 -0700 (Tue, 16 Jun 2009)

Log Message

<rdar://problem/6935468> Audit events are being missed because launchd is not setting the audit masks

Modified Paths

• trunk/launchd/src/launchd.c
• trunk/launchd/src/launchd_core_logic.c

Diff

--- trunk/launchd/src/launchd.c	2009-06-02 20:20:29 UTC (rev 23924)
+++ trunk/launchd/src/launchd.c	2009-06-16 19:30:19 UTC (rev 23925)
@@ -430,6 +430,7 @@
 	auditinfo_addr_t auinfo = {
 		.ai_termid = { .at_type = AU_IPv4 },
 		.ai_asid = AU_ASSIGN_ASID,
+		.ai_auid = AU_DEFAUDITID,
 		.ai_flags = sessionIsRoot,
 	};
 	

--- trunk/launchd/src/launchd_core_logic.c	2009-06-02 20:20:29 UTC (rev 23924)
+++ trunk/launchd/src/launchd_core_logic.c	2009-06-16 19:30:19 UTC (rev 23925)
@@ -4128,6 +4128,7 @@
 			.ai_auid = j->mach_uid,
 			.ai_asid = AU_ASSIGN_ASID,
 		};
+		(void)au_user_mask(j->username, &auinfo.ai_mask);
 		
 		if( !launchd_assumes(setaudit_addr(&auinfo, sizeof(auinfo)) != -1) ) {
 			runtime_syslog(LOG_WARNING, "Could not set audit session! (errno = %d)", errno);