tree 40481f42587257039bd7b898c2aec95e1c01656f
parent bde02ca858448cf54a4226774dd1481f3bcc455e
author Richard Guy Briggs <rgb@redhat.com> 1367604230 -0400
committer Eric Paris <eparis@redhat.com> 1367350288 -0400

audit: add an option to control logging of passwords with pam_tty_audit

Most commands are entered one line at a time and processed as complete lines
in non-canonical mode.  Commands that interactively require a password, enter
canonical mode to do this while shutting off echo.  This pair of features
(icanon and !echo) can be used to avoid logging passwords by audit while still
logging the rest of the command.

Adding a member (log_passwd) to the struct audit_tty_status passed in by
pam_tty_audit allows control of canonical mode without echo per task.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>