PAM misconfiguration for auditd results in audit trail loss

[Michael S. Fischer]

The auditd package included in Debian Wheezy and Ubuntu 12.04 LTS (and probably other Debian and Ubuntu releases as well) adds pam_loginuid.so to the /etc/pam.d/common-session and /etc/pam.d/common-session-noninteractive PAM sub-configuration files. These sub-configuration files are in turn included by reference in the /etc/pam.d/su and /etc/pam.d/sudo files. This results in pam_loginuid.so being included when the user context is switched by running su or sudo.

The man page for pam_loginuid, however, warns us not to do that, as this will cause the original user context to be lost in the audit logs (emphasis mine):

       The pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to
       be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd. There
       are probably other entry point applications besides these. You should not use it for applications like sudo or su as that defeats the
       purpose by changing the loginuid to the account they just switched to.

The fix, of course, is never to add pam_loginuid.so to any common PAM configuration file - or to exclude common-session and common-session-noninteractive from /etc/pam.d/su and /etc/pam.d/sudo, replacing it with the respective files' constituent lines, but without pam_loginuid.so.

[Jamie Strandboge (jdstrand)]

I can confirm that Ubuntu 12.04 and 12.10 have 'session required pam_loginuid.so' in common-session and common-session-noninteractive as a result of installing auditd.

FYI, Ubuntu 13.10 and 14.04 have 'session required pam_loginuid.so' in sshd only (unrelated to auditd).

[Jamie Strandboge (jdstrand)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. For the affected releases of Ubuntu, this package is in universe and is community maintained. We discussed this issue with the Debian maintainer do not feel it warrants a security update.

However, since it is community maintained you have the option of posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures'

Thanks again

[Rolf Leggewie (r0lf)]

quantal has seen the end of its life and is no longer receiving any updates. Marking the quantal task for this ticket as "Won't Fix".

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release