diff -urp shadow-4.1.5.1.orig/lib/prototypes.h shadow-4.1.5.1/lib/prototypes.h

--- shadow-4.1.5.1.orig/lib/prototypes.h	2014-09-13 15:45:54.953829562 -0400

+++ shadow-4.1.5.1/lib/prototypes.h	2014-10-14 08:39:23.785884075 -0400

@@ -195,12 +195,21 @@ extern int audit_fd;

 extern void audit_help_open (void);

 /* Use AUDIT_NO_ID when a name is provided to audit_logger instead of an ID */

 #define AUDIT_NO_ID	((unsigned int) -1)

+#ifndef AUDIT_GRP_MGMT

+#define AUDIT_GRP_MGMT          1132    /* Group account was modified */

+#endif

+#ifndef AUDIT_GRP_CHAUTHTOK

+#define AUDIT_GRP_CHAUTHTOK     1133    /* Group account password was changed */

+#endif

 typedef enum {

 	SHADOW_AUDIT_FAILURE = 0,

 	SHADOW_AUDIT_SUCCESS = 1} shadow_audit_result;

 extern void audit_logger (int type, const char *pgname, const char *op,

                           const char *name, unsigned int id,

                           shadow_audit_result result);

+void audit_logger_with_group (int type, unused const char *pgname,

+                const char *op, const char *name, unsigned int id, 

+                const char *grp, shadow_audit_result result);

 void audit_logger_message (const char *message, shadow_audit_result result);

 #endif

diff -urp shadow-4.1.5.1.orig/libmisc/audit_help.c shadow-4.1.5.1/libmisc/audit_help.c

--- shadow-4.1.5.1.orig/libmisc/audit_help.c	2010-08-21 07:41:28.000000000 -0400

+++ shadow-4.1.5.1/libmisc/audit_help.c	2014-10-14 08:39:23.785884075 -0400

@@ -68,7 +68,7 @@ void audit_help_open (void)

  * This function will log a message to the audit system using a predefined

  * message format. Parameter usage is as follows:

  *

- * type - type of message: AUDIT_USER_CHAUTHTOK for changing any account 

+ * type - type of message: AUDIT_USER_MGMT for changing any account 

  *	  attributes.

  * pgname - program's name

  * op  -  operation. "adding user", "changing finger info", "deleting group"

@@ -88,6 +88,39 @@ void audit_logger (int type, unused cons

 	}

 }

+/*

+ * This function will log a message to the audit system using a predefined

+ * message format. Parameter usage is as follows:

+ *

+ * type - type of message: AUDIT_USER_MGMT for changing any account 

+ *	  attributes.

+ * pgname - program's name

+ * op  -  operation. "adding user", "changing finger info", "deleting group"

+ * name - user's account or group name. If not available use NULL.

+ * id  -  uid or gid that the operation is being performed on. This is used

+ *	  only when user is NULL.

+ * grp - group name associated with event

+ */

+void audit_logger_with_group (int type, unused const char *pgname,

+		const char *op, const char *name, unsigned int id,

+		const char *grp, shadow_audit_result result)

+{

+	int len;

+	char enc_group[(GROUP_NAME_MAX_LENGTH*2)+1], buf[1024];

+	if (audit_fd < 0) {

+		return;

+	}

+	len = strnlen(grp, sizeof(enc_group)/2);

+	if (audit_value_needs_encoding(grp, len)) {

+		snprintf(buf, sizeof(buf), "%s grp=%s", op,

+			audit_encode_value(enc_group, grp, len));

+	} else {

+		snprintf(buf, sizeof(buf), "%s grp=\"%s\"", op, grp);

+	}

+	audit_log_acct_message (audit_fd, type, NULL, buf, name, id,

+		                        NULL, NULL, NULL, (int) result);

+}

+

 void audit_logger_message (const char *message, shadow_audit_result result)

 {

 	if (audit_fd < 0) {

diff -urp shadow-4.1.5.1.orig/libmisc/cleanup_group.c shadow-4.1.5.1/libmisc/cleanup_group.c

--- shadow-4.1.5.1.orig/libmisc/cleanup_group.c	2008-12-23 17:45:18.000000000 -0500

+++ shadow-4.1.5.1/libmisc/cleanup_group.c	2014-10-14 09:00:33.594753105 -0400

@@ -83,7 +83,7 @@ void cleanup_report_mod_group (void *cle

 	         gr_dbname (),

 	         info->action));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_USER_ACCT, Prog,

+	audit_logger (AUDIT_GRP_MGMT, Prog,

 	              info->audit_msg,

 	              info->name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

@@ -101,7 +101,7 @@ void cleanup_report_mod_gshadow (void *c

 	         sgr_dbname (),

 	         info->action));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_USER_ACCT, Prog,

+	audit_logger (AUDIT_GRP_MGMT, Prog,

 	              info->audit_msg,

 	              info->name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

@@ -122,7 +122,7 @@ void cleanup_report_add_group_group (voi

 	SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, gr_dbname ()));

 #ifdef WITH_AUDIT

 	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "adding group to /etc/group",

+	              "adding-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -141,8 +141,8 @@ void cleanup_report_add_group_gshadow (v

 	SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, sgr_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "adding group to /etc/gshadow",

+	audit_logger (AUDIT_GRP_MGMT, Prog,

+	              "adding-shadow-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -164,8 +164,8 @@ void cleanup_report_del_group_group (voi

 	         "failed to remove group %s from %s",

 	         name, gr_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "removing group from /etc/group",

+	audit_logger (AUDIT_DEL_GROUP, Prog,

+	              "removing-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -187,8 +187,8 @@ void cleanup_report_del_group_gshadow (v

 	         "failed to remove group %s from %s",

 	         name, sgr_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "removing group from /etc/gshadow",

+	audit_logger (AUDIT_GRP_MGMT, Prog,

+	              "removing-shadow-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -208,7 +208,7 @@ void cleanup_unlock_group (unused void *

 		         Prog, gr_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking group file",

+		audit_logger_message ("unlocking-group",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

@@ -228,7 +228,7 @@ void cleanup_unlock_gshadow (unused void

 		         Prog, sgr_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking gshadow file",

+		audit_logger_message ("unlocking-gshadow",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

diff -urp shadow-4.1.5.1.orig/libmisc/cleanup_user.c shadow-4.1.5.1/libmisc/cleanup_user.c

--- shadow-4.1.5.1.orig/libmisc/cleanup_user.c	2008-12-23 17:45:18.000000000 -0500

+++ shadow-4.1.5.1/libmisc/cleanup_user.c	2014-10-14 09:01:51.878745031 -0400

@@ -65,7 +65,7 @@ void cleanup_report_mod_passwd (void *cl

 	         pw_dbname (),

 	         info->action));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_USER_ACCT, Prog,

+	audit_logger (AUDIT_USER_MGMT, Prog,

 	              info->audit_msg,

 	              info->name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

@@ -86,7 +86,7 @@ void cleanup_report_add_user_passwd (voi

 	SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, pw_dbname ()));

 #ifdef WITH_AUDIT

 	audit_logger (AUDIT_ADD_USER, Prog,

-	              "adding user to /etc/passwd",

+	              "adding-user",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -105,8 +105,8 @@ void cleanup_report_add_user_shadow (voi

 	SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, spw_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_USER, Prog,

-	              "adding user to /etc/shadow",

+	audit_logger (AUDIT_USER_MGMT, Prog,

+	              "adding-shadow-user",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -125,7 +125,7 @@ void cleanup_unlock_passwd (unused void

 		         Prog, pw_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking passwd file",

+		audit_logger_message ("unlocking-passwd",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

@@ -144,7 +144,7 @@ void cleanup_unlock_shadow (unused void

 		         Prog, spw_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking shadow file",

+		audit_logger_message ("unlocking-shadow",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

diff -urp shadow-4.1.5.1.orig/src/chage.c shadow-4.1.5.1/src/chage.c

--- shadow-4.1.5.1.orig/src/chage.c	2011-11-19 17:54:47.000000000 -0500

+++ shadow-4.1.5.1/src/chage.c	2014-10-14 08:39:23.787884075 -0400

@@ -126,9 +126,10 @@ static /*@noreturn@*/void fail_exit (int

 #ifdef WITH_AUDIT

 	if (E_SUCCESS != code) {

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              "change age",

-		              user_name, (unsigned int) user_uid, 0);

+		audit_logger (AUDIT_USER_MGMT, Prog,

+		              "change-age",

+		              user_name, (unsigned int) user_uid,

+		              SHADOW_AUDIT_FAILURE);

 	}

 #endif

@@ -873,11 +874,7 @@ int main (int argc, char **argv)

 			fprintf (stderr, _("%s: Permission denied.\n"), Prog);

 			fail_exit (E_NOPERM);

 		}

-#ifdef WITH_AUDIT

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              "display aging info",

-		              user_name, (unsigned int) user_uid, 1);

-#endif

+		/* Displaying fields is not of interest to audit */

 		list_fields ();

 		fail_exit (E_SUCCESS);

 	}

@@ -896,41 +893,43 @@ int main (int argc, char **argv)

 		}

 #ifdef WITH_AUDIT

 		else {

-			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-			              "change all aging information",

-			              user_name, (unsigned int) user_uid, 1);

+			audit_logger (AUDIT_USER_MGMT, Prog,

+			              "change-all-aging-information",

+			              user_name, (unsigned int) user_uid,

+			              SHADOW_AUDIT_SUCCESS);

 		}

 #endif

 	} else {

 #ifdef WITH_AUDIT

 		if (Mflg) {

-			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-			              "change max age",

-			              user_name, (unsigned int) user_uid, 1);

+			audit_logger (AUDIT_USER_MGMT, Prog,

+			              "change-max-age",

+			              user_name, (unsigned int) user_uid,

+			              SHADOW_AUDIT_SUCCESS);

 		}

 		if (mflg) {

-			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-			              "change min age",

+			audit_logger (AUDIT_USER_MGMT, Prog,

+			              "change-min-age",

 			              user_name, (unsigned int) user_uid, 1);

 		}

 		if (dflg) {

-			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-			              "change last change date",

+			audit_logger (AUDIT_USER_MGMT, Prog,

+			              "change-last-change-date",

 			              user_name, (unsigned int) user_uid, 1);

 		}

 		if (Wflg) {

-			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-			              "change passwd warning",

+			audit_logger (AUDIT_USER_MGMT, Prog,

+			              "change-passwd-warning",

 			              user_name, (unsigned int) user_uid, 1);

 		}

 		if (Iflg) {

-			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-			              "change inactive days",

+			audit_logger (AUDIT_USER_MGMT, Prog,

+			              "change-inactive-days",

 			              user_name, (unsigned int) user_uid, 1);

 		}

 		if (Eflg) {

-			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-			              "change passwd expiration",

+			audit_logger (AUDIT_USER_MGMT, Prog,

+			              "change-passwd-expiration",

 			              user_name, (unsigned int) user_uid, 1);

 		}

 #endif

diff -urp shadow-4.1.5.1.orig/src/gpasswd.c shadow-4.1.5.1/src/gpasswd.c

--- shadow-4.1.5.1.orig/src/gpasswd.c	2014-09-13 15:45:54.989829559 -0400

+++ shadow-4.1.5.1/src/gpasswd.c	2014-10-14 08:43:07.393861012 -0400

@@ -137,7 +137,7 @@ static void usage (int status)

 	(void) fputs (_("  -d, --delete USER             remove USER from GROUP\n"), usageout);

 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);

 	(void) fputs (_("  -Q, --root CHROOT_DIR         directory to chroot into\n"), usageout);

-	(void) fputs (_("  -r, --remove-password         remove the GROUP's password\n"), usageout);

+	(void) fputs (_("  -r, --delete-password         remove the GROUP's password\n"), usageout);

 	(void) fputs (_("  -R, --restrict                restrict access to GROUP to its members\n"), usageout);

 	(void) fputs (_("  -M, --members USER,...        set the list of members of GROUP\n"), usageout);

 #ifdef SHADOWGRP

@@ -397,21 +397,14 @@ static void open_files (void)

 static void log_gpasswd_failure (const char *suffix)

 {

-#ifdef WITH_AUDIT

-	char buf[1024];

-#endif

 	if (aflg) {

 		SYSLOG ((LOG_ERR,

 		         "%s failed to add user %s to group %s%s",

 		         myname, user, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to add user %s to group %s%s",

-		          myname, user, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "add-user-to-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (dflg) {

@@ -419,13 +412,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to remove user %s from group %s%s",

 		         myname, user, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to remove user %s from group %s%s",

-		          myname, user, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "delete-user-from-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (rflg) {

@@ -433,13 +422,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to remove password of group %s%s",

 		         myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to remove password of group %s%s",

-		          myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "delete-group-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (Rflg) {

@@ -447,13 +432,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to restrict access to group %s%s",

 		         myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to restrict access to group %s%s",

-		          myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+		              "restrict-group",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (Aflg || Mflg) {

@@ -463,13 +444,9 @@ static void log_gpasswd_failure (const c

 			         "%s failed to set the administrators of group %s to %s%s",

 			         myname, group, admins, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "%s failed to set the administrators of group %s to %s%s",

-			          myname, group, admins, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+			              "set-admins-of-group",

+			              admins, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_FAILURE);

 #endif

 		}

@@ -479,13 +456,9 @@ static void log_gpasswd_failure (const c

 			         "%s failed to set the members of group %s to %s%s",

 			         myname, group, members, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "%s failed to set the members of group %s to %s%s",

-			          myname, group, members, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+			              "add-users-to-group",

+			              members, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_FAILURE);

 #endif

 		}

@@ -494,13 +467,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to change password of group %s%s",

 		         myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to change password of group %s%s",

-		          myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "change-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	}

@@ -531,21 +500,14 @@ static void log_gpasswd_failure_gshadow

 static void log_gpasswd_success (const char *suffix)

 {

-#ifdef WITH_AUDIT

-	char buf[1024];

-#endif

 	if (aflg) {

 		SYSLOG ((LOG_INFO,

 		         "user %s added by %s to group %s%s",

 		         user, myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "user %s added by %s to group %s%s",

-		          user, myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "add-user-to-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (dflg) {

@@ -553,13 +515,9 @@ static void log_gpasswd_success (const c

 		         "user %s removed by %s from group %s%s",

 		         user, myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "user %s removed by %s from group %s%s",

-		          user, myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "delete-user-from-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (rflg) {

@@ -567,13 +525,9 @@ static void log_gpasswd_success (const c

 		         "password of group %s removed by %s%s",

 		         group, myname, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "password of group %s removed by %s%s",

-		          group, myname, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "delete-group-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (Rflg) {

@@ -581,13 +535,9 @@ static void log_gpasswd_success (const c

 		         "access to group %s restricted by %s%s",

 		         group, myname, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "access to group %s restricted by %s%s",

-		          group, myname, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+		              "restrict-group",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (Aflg || Mflg) {

@@ -597,13 +547,9 @@ static void log_gpasswd_success (const c

 			         "administrators of group %s set by %s to %s%s",

 			         group, myname, admins, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "administrators of group %s set by %s to %s%s",

-			          group, myname, admins, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+			              "set-admins-of-group",

+			              admins, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_SUCCESS);

 #endif

 		}

@@ -613,13 +559,9 @@ static void log_gpasswd_success (const c

 			         "members of group %s set by %s to %s%s",

 			         group, myname, members, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "members of group %s set by %s to %s%s",

-			          group, myname, members, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+			              "add-users-to-group",

+			              members, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_SUCCESS);

 #endif

 		}

@@ -628,13 +570,9 @@ static void log_gpasswd_success (const c

 		         "password of group %s changed by %s%s",

 		         group, myname, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "password of group %s changed by %s%s",

-		          group, myname, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "change-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	}

diff -urp shadow-4.1.5.1.orig/src/groupadd.c shadow-4.1.5.1/src/groupadd.c

--- shadow-4.1.5.1.orig/src/groupadd.c	2011-11-18 16:23:30.000000000 -0500

+++ shadow-4.1.5.1/src/groupadd.c	2014-10-14 08:39:23.800884073 -0400

@@ -127,6 +127,15 @@ static /*@noreturn@*/void usage (int sta

 	exit (status);

 }

+static void fail_exit(int status)

+{

+#ifdef WITH_AUDIT

+	audit_logger(AUDIT_ADD_GROUP, Prog, "add-group", group_name,

+			AUDIT_NO_ID, SHADOW_AUDIT_FAILURE);

+#endif

+	exit (status);

+}

+

 /*

  * new_grent - initialize the values in a group file entry

  *

@@ -210,7 +219,7 @@ static void grp_update (void)

 		fprintf (stderr,

 		         _("%s: failed to prepare the new %s entry '%s'\n"),

 		         Prog, gr_dbname (), grp.gr_name);

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef	SHADOWGRP

 	/*

@@ -220,7 +229,7 @@ static void grp_update (void)

 		fprintf (stderr,

 		         _("%s: failed to prepare the new %s entry '%s'\n"),

 		         Prog, sgr_dbname (), sgrp.sg_name);

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #endif				/* SHADOWGRP */

 }

@@ -244,7 +253,7 @@ static void check_new_name (void)

 	fprintf (stderr, _("%s: '%s' is not a valid group name\n"),

 	         Prog, group_name);

-	exit (E_BAD_ARG);

+	fail_exit (E_BAD_ARG);

 }

 /*

@@ -260,11 +269,11 @@ static void close_files (void)

 		fprintf (stderr,

 		         _("%s: failure while writing changes to %s\n"),

 		         Prog, gr_dbname ());

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef WITH_AUDIT

 	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "adding group to /etc/group",

+	              "add-group",

 	              group_name, (unsigned int) group_id,

 	              SHADOW_AUDIT_SUCCESS);

 #endif

@@ -282,11 +291,11 @@ static void close_files (void)

 			fprintf (stderr,

 			         _("%s: failure while writing changes to %s\n"),

 			         Prog, sgr_dbname ());

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 #ifdef WITH_AUDIT

-		audit_logger (AUDIT_ADD_GROUP, Prog,

-		              "adding group to /etc/gshadow",

+		audit_logger (AUDIT_GRP_MGMT, Prog,

+		              "add-shadow-group",

 		              group_name, (unsigned int) group_id,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

@@ -300,12 +309,6 @@ static void close_files (void)

 #endif				/* SHADOWGRP */

 	/* Report success at the system level */

-#ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "",

-	              group_name, (unsigned int) group_id,

-	              SHADOW_AUDIT_SUCCESS);

-#endif

 	SYSLOG ((LOG_INFO, "new group: name=%s, GID=%u",

 	         group_name, (unsigned int) group_id));

 	del_cleanup (cleanup_report_add_group);

@@ -323,7 +326,7 @@ static void open_files (void)

 		fprintf (stderr,

 		         _("%s: cannot lock %s; try again later.\n"),

 		         Prog, gr_dbname ());

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 	add_cleanup (cleanup_unlock_group, NULL);

@@ -333,7 +336,7 @@ static void open_files (void)

 			fprintf (stderr,

 			         _("%s: cannot lock %s; try again later.\n"),

 			         Prog, sgr_dbname ());

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 		add_cleanup (cleanup_unlock_gshadow, NULL);

 	}

@@ -349,7 +352,7 @@ static void open_files (void)

 	if (gr_open (O_RDWR) == 0) {

 		fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());

 		SYSLOG ((LOG_WARN, "cannot open %s", gr_dbname ()));

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef	SHADOWGRP

@@ -359,7 +362,7 @@ static void open_files (void)

 			         _("%s: cannot open %s\n"),

 			         Prog, sgr_dbname ());

 			SYSLOG ((LOG_WARN, "cannot open %s", sgr_dbname ()));

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 	}

 #endif				/* SHADOWGRP */

@@ -489,7 +492,7 @@ static void check_flags (void)

 		fprintf (stderr,

 		         _("%s: group '%s' already exists\n"),

 		         Prog, group_name);

-		exit (E_NAME_IN_USE);

+		fail_exit (E_NAME_IN_USE);

 	}

 	if (gflg && (getgrgid (group_id) != NULL)) {

@@ -508,7 +511,7 @@ static void check_flags (void)

 			fprintf (stderr,

 			         _("%s: GID '%lu' already exists\n"),

 			         Prog, (unsigned long int) group_id);

-			exit (E_GID_IN_USE);

+			fail_exit (E_GID_IN_USE);

 		}

 	}

 }

@@ -536,7 +539,7 @@ static void check_perms (void)

 		fprintf (stderr,

 		         _("%s: Cannot determine your user name.\n"),

 		         Prog);

-		exit (1);

+		fail_exit (1);

 	}

 	retval = pam_start ("groupadd", pampw->pw_name, &conv, &pamh);

@@ -556,7 +559,7 @@ static void check_perms (void)

 		if (NULL != pamh) {

 			(void) pam_end (pamh, retval);

 		}