pam: Setup logging to syslog

We already log to syslog using pam_syslog() for logs generated directly
within our pam plugins. However, any logs generated by our generic logging
macros that are invoked within a pam plugin will log to the console. Let's
make sure our generic logging macros are set up to log to syslog as well.

diff --git a/src/home/pam_systemd_home.c b/src/home/pam_systemd_home.c
index c348b7f268affa152362b68d108120625fd376ff..4616f086ed0aaa7a20065f07d355eac9b23b0967 100644 (file)
--- a/src/home/pam_systemd_home.c
+++ b/src/home/pam_systemd_home.c
@@ -750,6 +750,8 @@ _public_ PAM_EXTERN int pam_sm_authenticate(
         AcquireHomeFlags flags = 0;
         bool debug = false;
 
+        pam_log_setup();
+
         if (parse_env(handle, &flags) < 0)
                 return PAM_AUTH_ERR;
 
@@ -811,6 +813,8 @@ _public_ PAM_EXTERN int pam_sm_open_session(
         bool debug = false;
         int r;
 
+        pam_log_setup();
+
         if (parse_env(handle, &flags) < 0)
                 return PAM_SESSION_ERR;
 
@@ -862,6 +866,8 @@ _public_ PAM_EXTERN int pam_sm_close_session(
         bool debug = false;
         int r;
 
+        pam_log_setup();
+
         if (parse_argv(handle,
                        argc, argv,
                        NULL,
@@ -922,6 +928,8 @@ _public_ PAM_EXTERN int pam_sm_acct_mgmt(
         usec_t t;
         int r;
 
+        pam_log_setup();
+
         if (parse_env(handle, &flags) < 0)
                 return PAM_AUTH_ERR;
 
@@ -1039,6 +1047,8 @@ _public_ PAM_EXTERN int pam_sm_chauthtok(
         bool debug = false;
         int r;
 
+        pam_log_setup();
+
         if (parse_argv(handle,
                        argc, argv,
                        NULL,

diff --git a/src/login/pam_systemd.c b/src/login/pam_systemd.c
index 2ea3f6c85089d4a242609e8823a0475b08987d5e..e01f35b65e445457895dc90622900f8249c24b64 100644 (file)
--- a/src/login/pam_systemd.c
+++ b/src/login/pam_systemd.c
@@ -929,6 +929,8 @@ _public_ PAM_EXTERN int pam_sm_open_session(
 
         assert(handle);
 
+        pam_log_setup();
+
         if (parse_argv(handle,
                        argc, argv,
                        &class_pam,
@@ -1230,6 +1232,8 @@ _public_ PAM_EXTERN int pam_sm_close_session(
 
         assert(handle);
 
+        pam_log_setup();
+
         if (parse_argv(handle,
                        argc, argv,
                        NULL,

diff --git a/src/login/pam_systemd_loadkey.c b/src/login/pam_systemd_loadkey.c
index 3b4e91124a2483e9a4f922878218dd09fef6c37d..2e65d606085f76632bfb74c0d82450ce2dd56945 100644 (file)
--- a/src/login/pam_systemd_loadkey.c
+++ b/src/login/pam_systemd_loadkey.c
@@ -25,6 +25,8 @@ _public_ int pam_sm_authenticate(
 
         assert(handle);
 
+        pam_log_setup();
+
         /* Parse argv. */
 
         assert(argc >= 0);

diff --git a/src/shared/pam-util.c b/src/shared/pam-util.c
index d626b2817bc9101fd9b2f5ac124545942d2d0502..3cbe431531c1b7834032b035f87e9264cccaa87a 100644 (file)
--- a/src/shared/pam-util.c
+++ b/src/shared/pam-util.c
@@ -14,6 +14,14 @@
 #include "stdio-util.h"
 #include "string-util.h"
 
+void pam_log_setup(void) {
+        /* Make sure we don't leak the syslog fd we open by opening/closing the fd each time. */
+        log_set_open_when_needed(true);
+
+        /* pam logs to syslog so let's make our generic logging functions do the same thing. */
+        log_set_target(LOG_TARGET_SYSLOG);
+}
+
 int pam_syslog_errno(pam_handle_t *handle, int level, int error, const char *format, ...) {
         va_list ap;
 

diff --git a/src/shared/pam-util.h b/src/shared/pam-util.h
index 51bffc329e56afb5b7302ab9c2e28b544f4b0efe..d627eb733fcf086fab95fe3dd6fdaad59878b04c 100644 (file)
--- a/src/shared/pam-util.h
+++ b/src/shared/pam-util.h
@@ -5,6 +5,8 @@
 
 #include "sd-bus.h"
 
+void pam_log_setup(void);
+
 int pam_syslog_errno(pam_handle_t *handle, int level, int error, const char *format, ...) _printf_(4,5);
 
 int pam_syslog_pam_error(pam_handle_t *handle, int level, int error, const char *format, ...) _printf_(4,5);