[MDEV-19443] server_audit plugin doesn't log proxy users Created: 2019-05-11  Updated: 2024-01-29  Resolved: 2020-10-23

Status: Closed
Project: MariaDB Server
Component/s: Authentication and Privilege System, Plugin - Audit
Affects Version/s: 10.2.24, 10.1.40, 10.3.14, 10.4.4
Fix Version/s: 10.2.35, 10.3.26, 10.4.16, 10.5.7

Type: Bug Priority: Critical
Reporter: Geoff Montee (Inactive) Assignee: Alexey Botchkov
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-5313 Improving audit api Stalled
relates to MDEV-5983 Auditing plugin v2.0 Closed
relates to MDEV-19442 server_audit plugin doesn't consider ... Closed

 Description   

The server_audit plugin doesn't log proxy users. This means that it doesn't work well with PAM user mapping:

https://mariadb.com/kb/en/library/user-and-group-mapping-with-pam/

This seems to be true for all of the log functions:

https://github.com/MariaDB/server/blob/mariadb-10.4.4/plugin/server_audit/server_audit.c#L1311

https://github.com/MariaDB/server/blob/mariadb-10.4.4/plugin/server_audit/server_audit.c#L1333

https://github.com/MariaDB/server/blob/mariadb-10.4.4/plugin/server_audit/server_audit.c#L1756

https://github.com/MariaDB/server/blob/mariadb-10.4.4/plugin/server_audit/server_audit.c#L1587

However, I see that the API already provides proxy_user in the mysql_event_connection and mysql_event_table classes.

https://github.com/MariaDB/server/blob/mariadb-10.4.4/include/mysql/plugin_audit.h#L86

https://github.com/MariaDB/server/blob/mariadb-10.4.4/include/mysql/plugin_audit.h#L127

But proxy_user seems to be missing from the mysql_event_general class:

https://github.com/MariaDB/server/blob/mariadb-10.4.4/include/mysql/plugin_audit.h#L52

For example, let's say that I log in as the bob PAM user who is mapped to the dba user:

[ec2-user@ip-172-30-0-249 ~]$ mysql -u bob
[mariadb] Password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 13
Server version: 10.1.39-MariaDB MariaDB Server
 
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
MariaDB [(none)]> SELECT USER(), CURRENT_USER();
+---------------+----------------+
| USER()        | CURRENT_USER() |
+---------------+----------------+
| bob@localhost | dba@%          |
+---------------+----------------+
1 row in set (0.00 sec)
 
MariaDB [(none)]> SELECT 1;
+---+
| 1 |
+---+
| 1 |
+---+
1 row in set (0.00 sec)
 
MariaDB [(none)]> \q
Bye

The audit log will only show the user name bob:

20190511 22:50:30,ip-172-30-0-249.us-west-2.compute.internal,bob,localhost,13,0,CONNECT,,,0
20190511 22:50:30,ip-172-30-0-249.us-west-2.compute.internal,bob,localhost,13,21,QUERY,,'select @@version_comment limit 1',0
20190511 22:50:32,ip-172-30-0-249.us-west-2.compute.internal,bob,localhost,13,22,QUERY,,'SELECT USER(), CURRENT_USER()',0
20190511 22:50:40,ip-172-30-0-249.us-west-2.compute.internal,bob,localhost,13,23,QUERY,,'SELECT 1',0
20190511 22:50:43,ip-172-30-0-249.us-west-2.compute.internal,bob,localhost,13,0,DISCONNECT,,,0

To have a more complete audit trail, shouldn't the plugin log both the original user and the proxy user?



 Comments   
Comment by Alexey Botchkov [ 2020-10-23 ]

https://github.com/MariaDB/server/commit/cc1646dae821a136c8368ee84954aac9937abdd4

Generated at Thu Feb 08 08:51:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.