diff -up shadow-4.6/libmisc/audit_help.c.audit-update shadow-4.6/libmisc/audit_help.c

--- shadow-4.6/libmisc/audit_help.c.audit-update	2018-04-29 18:42:37.000000000 +0200

+++ shadow-4.6/libmisc/audit_help.c	2018-05-28 15:01:09.913717564 +0200

@@ -68,7 +68,7 @@ void audit_help_open (void)

  * This function will log a message to the audit system using a predefined

  * message format. Parameter usage is as follows:

  *

- * type - type of message: AUDIT_USER_CHAUTHTOK for changing any account 

+ * type - type of message: AUDIT_USER_MGMT for changing any account 

  *	  attributes.

  * pgname - program's name

  * op  -  operation. "adding user", "changing finger info", "deleting group"

@@ -88,6 +88,39 @@ void audit_logger (int type, unused cons

 	}

 }

+/*

+ * This function will log a message to the audit system using a predefined

+ * message format. Parameter usage is as follows:

+ *

+ * type - type of message: AUDIT_USER_MGMT for changing any account 

+ *	  attributes.

+ * pgname - program's name

+ * op  -  operation. "adding user", "changing finger info", "deleting group"

+ * name - user's account or group name. If not available use NULL.

+ * id  -  uid or gid that the operation is being performed on. This is used

+ *	  only when user is NULL.

+ * grp - group name associated with event

+ */

+void audit_logger_with_group (int type, unused const char *pgname,

+		const char *op, const char *name, unsigned int id,

+		const char *grp, shadow_audit_result result)

+{

+	int len;

+	char enc_group[(GROUP_NAME_MAX_LENGTH*2)+1], buf[1024];

+	if (audit_fd < 0) {

+		return;

+	}

+	len = strnlen(grp, sizeof(enc_group)/2);

+	if (audit_value_needs_encoding(grp, len)) {

+		snprintf(buf, sizeof(buf), "%s grp=%s", op,

+			audit_encode_value(enc_group, grp, len));

+	} else {

+		snprintf(buf, sizeof(buf), "%s grp=\"%s\"", op, grp);

+	}

+	audit_log_acct_message (audit_fd, type, NULL, buf, name, id,

+		                        NULL, NULL, NULL, (int) result);

+}

+

 void audit_logger_message (const char *message, shadow_audit_result result)

 {

 	if (audit_fd < 0) {

diff -up shadow-4.6/libmisc/cleanup_group.c.audit-update shadow-4.6/libmisc/cleanup_group.c

--- shadow-4.6/libmisc/cleanup_group.c.audit-update	2018-04-29 18:42:37.000000000 +0200

+++ shadow-4.6/libmisc/cleanup_group.c	2018-05-28 15:01:09.913717564 +0200

@@ -83,7 +83,7 @@ void cleanup_report_mod_group (void *cle

 	         gr_dbname (),

 	         info->action));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_USER_ACCT, Prog,

+	audit_logger (AUDIT_GRP_MGMT, Prog,

 	              info->audit_msg,

 	              info->name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

@@ -101,7 +101,7 @@ void cleanup_report_mod_gshadow (void *c

 	         sgr_dbname (),

 	         info->action));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_USER_ACCT, Prog,

+	audit_logger (AUDIT_GRP_MGMT, Prog,

 	              info->audit_msg,

 	              info->name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

@@ -122,7 +122,7 @@ void cleanup_report_add_group_group (voi

 	SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, gr_dbname ()));

 #ifdef WITH_AUDIT

 	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "adding group to /etc/group",

+	              "adding-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -141,8 +141,8 @@ void cleanup_report_add_group_gshadow (v

 	SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, sgr_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "adding group to /etc/gshadow",

+	audit_logger (AUDIT_GRP_MGMT, Prog,

+	              "adding-shadow-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -164,8 +164,8 @@ void cleanup_report_del_group_group (voi

 	         "failed to remove group %s from %s",

 	         name, gr_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "removing group from /etc/group",

+	audit_logger (AUDIT_DEL_GROUP, Prog,

+	              "removing-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -187,8 +187,8 @@ void cleanup_report_del_group_gshadow (v

 	         "failed to remove group %s from %s",

 	         name, sgr_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "removing group from /etc/gshadow",

+	audit_logger (AUDIT_GRP_MGMT, Prog,

+	              "removing-shadow-group",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -208,7 +208,7 @@ void cleanup_unlock_group (unused void *

 		         Prog, gr_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking group file",

+		audit_logger_message ("unlocking-group",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

@@ -228,7 +228,7 @@ void cleanup_unlock_gshadow (unused void

 		         Prog, sgr_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking gshadow file",

+		audit_logger_message ("unlocking-gshadow",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

diff -up shadow-4.6/libmisc/cleanup_user.c.audit-update shadow-4.6/libmisc/cleanup_user.c

--- shadow-4.6/libmisc/cleanup_user.c.audit-update	2018-04-29 18:42:37.000000000 +0200

+++ shadow-4.6/libmisc/cleanup_user.c	2018-05-28 15:01:09.913717564 +0200

@@ -65,7 +65,7 @@ void cleanup_report_mod_passwd (void *cl

 	         pw_dbname (),

 	         info->action));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_USER_ACCT, Prog,

+	audit_logger (AUDIT_USER_MGMT, Prog,

 	              info->audit_msg,

 	              info->name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

@@ -86,7 +86,7 @@ void cleanup_report_add_user_passwd (voi

 	SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, pw_dbname ()));

 #ifdef WITH_AUDIT

 	audit_logger (AUDIT_ADD_USER, Prog,

-	              "adding user to /etc/passwd",

+	              "adding-user",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -105,8 +105,8 @@ void cleanup_report_add_user_shadow (voi

 	SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, spw_dbname ()));

 #ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_USER, Prog,

-	              "adding user to /etc/shadow",

+	audit_logger (AUDIT_USER_MGMT, Prog,

+	              "adding-shadow-user",

 	              name, AUDIT_NO_ID,

 	              SHADOW_AUDIT_FAILURE);

 #endif

@@ -125,7 +125,7 @@ void cleanup_unlock_passwd (unused void

 		         Prog, pw_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking passwd file",

+		audit_logger_message ("unlocking-passwd",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

@@ -144,7 +144,7 @@ void cleanup_unlock_shadow (unused void

 		         Prog, spw_dbname ());

 		SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ()));

 #ifdef WITH_AUDIT

-		audit_logger_message ("unlocking shadow file",

+		audit_logger_message ("unlocking-shadow",

 		                      SHADOW_AUDIT_FAILURE);

 #endif

 	}

diff -up shadow-4.6/lib/prototypes.h.audit-update shadow-4.6/lib/prototypes.h

--- shadow-4.6/lib/prototypes.h.audit-update	2018-05-28 15:01:09.901717309 +0200

+++ shadow-4.6/lib/prototypes.h	2018-05-28 15:01:09.913717564 +0200

@@ -211,12 +211,21 @@ extern int audit_fd;

 extern void audit_help_open (void);

 /* Use AUDIT_NO_ID when a name is provided to audit_logger instead of an ID */

 #define AUDIT_NO_ID	((unsigned int) -1)

+#ifndef AUDIT_GRP_MGMT

+#define AUDIT_GRP_MGMT          1132    /* Group account was modified */

+#endif

+#ifndef AUDIT_GRP_CHAUTHTOK

+#define AUDIT_GRP_CHAUTHTOK     1133    /* Group account password was changed */

+#endif

 typedef enum {

 	SHADOW_AUDIT_FAILURE = 0,

 	SHADOW_AUDIT_SUCCESS = 1} shadow_audit_result;

 extern void audit_logger (int type, const char *pgname, const char *op,

                           const char *name, unsigned int id,

                           shadow_audit_result result);

+void audit_logger_with_group (int type, unused const char *pgname,

+                const char *op, const char *name, unsigned int id, 

+                const char *grp, shadow_audit_result result);

 void audit_logger_message (const char *message, shadow_audit_result result);

 #endif

diff -up shadow-4.6/src/gpasswd.c.audit-update shadow-4.6/src/gpasswd.c

--- shadow-4.6/src/gpasswd.c.audit-update	2018-04-29 18:42:37.000000000 +0200

+++ shadow-4.6/src/gpasswd.c	2018-05-28 15:01:09.914717585 +0200

@@ -137,7 +137,7 @@ static void usage (int status)

 	(void) fputs (_("  -d, --delete USER             remove USER from GROUP\n"), usageout);

 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);

 	(void) fputs (_("  -Q, --root CHROOT_DIR         directory to chroot into\n"), usageout);

-	(void) fputs (_("  -r, --remove-password         remove the GROUP's password\n"), usageout);

+	(void) fputs (_("  -r, --delete-password         remove the GROUP's password\n"), usageout);

 	(void) fputs (_("  -R, --restrict                restrict access to GROUP to its members\n"), usageout);

 	(void) fputs (_("  -M, --members USER,...        set the list of members of GROUP\n"), usageout);

 #ifdef SHADOWGRP

@@ -396,21 +396,14 @@ static void open_files (void)

 static void log_gpasswd_failure (const char *suffix)

 {

-#ifdef WITH_AUDIT

-	char buf[1024];

-#endif

 	if (aflg) {

 		SYSLOG ((LOG_ERR,

 		         "%s failed to add user %s to group %s%s",

 		         myname, user, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to add user %s to group %s%s",

-		          myname, user, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "add-user-to-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (dflg) {

@@ -418,13 +411,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to remove user %s from group %s%s",

 		         myname, user, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to remove user %s from group %s%s",

-		          myname, user, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "delete-user-from-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (rflg) {

@@ -432,13 +421,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to remove password of group %s%s",

 		         myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to remove password of group %s%s",

-		          myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "delete-group-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (Rflg) {

@@ -446,13 +431,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to restrict access to group %s%s",

 		         myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to restrict access to group %s%s",

-		          myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+		              "restrict-group",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	} else if (Aflg || Mflg) {

@@ -462,13 +443,9 @@ static void log_gpasswd_failure (const c

 			         "%s failed to set the administrators of group %s to %s%s",

 			         myname, group, admins, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "%s failed to set the administrators of group %s to %s%s",

-			          myname, group, admins, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+			              "set-admins-of-group",

+			              admins, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_FAILURE);

 #endif

 		}

@@ -478,13 +455,9 @@ static void log_gpasswd_failure (const c

 			         "%s failed to set the members of group %s to %s%s",

 			         myname, group, members, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "%s failed to set the members of group %s to %s%s",

-			          myname, group, members, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+			              "add-users-to-group",

+			              members, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_FAILURE);

 #endif

 		}

@@ -493,13 +466,9 @@ static void log_gpasswd_failure (const c

 		         "%s failed to change password of group %s%s",

 		         myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "%s failed to change password of group %s%s",

-		          myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "change-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_FAILURE);

 #endif

 	}

@@ -530,21 +499,14 @@ static void log_gpasswd_failure_gshadow

 static void log_gpasswd_success (const char *suffix)

 {

-#ifdef WITH_AUDIT

-	char buf[1024];

-#endif

 	if (aflg) {

 		SYSLOG ((LOG_INFO,

 		         "user %s added by %s to group %s%s",

 		         user, myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "user %s added by %s to group %s%s",

-		          user, myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "add-user-to-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (dflg) {

@@ -552,13 +514,9 @@ static void log_gpasswd_success (const c

 		         "user %s removed by %s from group %s%s",

 		         user, myname, group, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "user %s removed by %s from group %s%s",

-		          user, myname, group, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_ACCT, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+		              "delete-user-from-group",

+		              user, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (rflg) {

@@ -566,13 +524,9 @@ static void log_gpasswd_success (const c

 		         "password of group %s removed by %s%s",

 		         group, myname, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "password of group %s removed by %s%s",

-		          group, myname, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "delete-group-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (Rflg) {

@@ -580,13 +534,9 @@ static void log_gpasswd_success (const c

 		         "access to group %s restricted by %s%s",

 		         group, myname, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "access to group %s restricted by %s%s",

-		          group, myname, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+		              "restrict-group",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	} else if (Aflg || Mflg) {

@@ -596,13 +546,9 @@ static void log_gpasswd_success (const c

 			         "administrators of group %s set by %s to %s%s",

 			         group, myname, admins, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "administrators of group %s set by %s to %s%s",

-			          group, myname, admins, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_GRP_MGMT, Prog,

+			              "set-admins-of-group",

+			              admins, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_SUCCESS);

 #endif

 		}

@@ -612,13 +558,9 @@ static void log_gpasswd_success (const c

 			         "members of group %s set by %s to %s%s",

 			         group, myname, members, suffix));

 #ifdef WITH_AUDIT

-			snprintf (buf, 1023,

-			          "members of group %s set by %s to %s%s",

-			          group, myname, members, suffix);

-			buf[1023] = '\0';

-			audit_logger (AUDIT_USER_ACCT, Prog,

-			              buf,

-			              group, AUDIT_NO_ID,

+			audit_logger_with_group (AUDIT_USER_MGMT, Prog,

+			              "add-users-to-group",

+			              members, AUDIT_NO_ID, group,

 			              SHADOW_AUDIT_SUCCESS);

 #endif

 		}

@@ -627,13 +569,9 @@ static void log_gpasswd_success (const c

 		         "password of group %s changed by %s%s",

 		         group, myname, suffix));

 #ifdef WITH_AUDIT

-		snprintf (buf, 1023,

-		          "password of group %s changed by %s%s",

-		          group, myname, suffix);

-		buf[1023] = '\0';

-		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,

-		              buf,

-		              group, AUDIT_NO_ID,

+		audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,

+		              "change-password",

+		              myname, AUDIT_NO_ID, group,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

 	}

diff -up shadow-4.6/src/groupadd.c.audit-update shadow-4.6/src/groupadd.c

--- shadow-4.6/src/groupadd.c.audit-update	2018-04-29 18:42:37.000000000 +0200

+++ shadow-4.6/src/groupadd.c	2018-05-28 15:02:53.137910337 +0200

@@ -130,6 +130,15 @@ static /*@noreturn@*/void usage (int sta

 	exit (status);

 }

+static void fail_exit(int status)

+{

+#ifdef WITH_AUDIT

+	audit_logger(AUDIT_ADD_GROUP, Prog, "add-group", group_name,

+			AUDIT_NO_ID, SHADOW_AUDIT_FAILURE);

+#endif

+	exit (status);

+}

+

 /*

  * new_grent - initialize the values in a group file entry

  *

@@ -213,7 +222,7 @@ static void grp_update (void)

 		fprintf (stderr,

 		         _("%s: failed to prepare the new %s entry '%s'\n"),

 		         Prog, gr_dbname (), grp.gr_name);

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef	SHADOWGRP

 	/*

@@ -223,7 +232,7 @@ static void grp_update (void)

 		fprintf (stderr,

 		         _("%s: failed to prepare the new %s entry '%s'\n"),

 		         Prog, sgr_dbname (), sgrp.sg_name);

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #endif				/* SHADOWGRP */

 }

@@ -247,7 +256,7 @@ static void check_new_name (void)

 	fprintf (stderr, _("%s: '%s' is not a valid group name\n"),

 	         Prog, group_name);

-	exit (E_BAD_ARG);

+	fail_exit (E_BAD_ARG);

 }

 /*

@@ -263,11 +272,11 @@ static void close_files (void)

 		fprintf (stderr,

 		         _("%s: failure while writing changes to %s\n"),

 		         Prog, gr_dbname ());

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef WITH_AUDIT

 	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "adding group to /etc/group",

+	              "add-group",

 	              group_name, (unsigned int) group_id,

 	              SHADOW_AUDIT_SUCCESS);

 #endif

@@ -285,11 +294,11 @@ static void close_files (void)

 			fprintf (stderr,

 			         _("%s: failure while writing changes to %s\n"),

 			         Prog, sgr_dbname ());

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 #ifdef WITH_AUDIT

-		audit_logger (AUDIT_ADD_GROUP, Prog,

-		              "adding group to /etc/gshadow",

+		audit_logger (AUDIT_GRP_MGMT, Prog,

+		              "add-shadow-group",

 		              group_name, (unsigned int) group_id,

 		              SHADOW_AUDIT_SUCCESS);

 #endif

@@ -303,12 +312,6 @@ static void close_files (void)

 #endif				/* SHADOWGRP */

 	/* Report success at the system level */

-#ifdef WITH_AUDIT

-	audit_logger (AUDIT_ADD_GROUP, Prog,

-	              "",

-	              group_name, (unsigned int) group_id,

-	              SHADOW_AUDIT_SUCCESS);

-#endif

 	SYSLOG ((LOG_INFO, "new group: name=%s, GID=%u",

 	         group_name, (unsigned int) group_id));

 	del_cleanup (cleanup_report_add_group);

@@ -326,7 +329,7 @@ static void open_files (void)

 		fprintf (stderr,

 		         _("%s: cannot lock %s; try again later.\n"),

 		         Prog, gr_dbname ());

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 	add_cleanup (cleanup_unlock_group, NULL);

@@ -336,7 +339,7 @@ static void open_files (void)

 			fprintf (stderr,

 			         _("%s: cannot lock %s; try again later.\n"),

 			         Prog, sgr_dbname ());

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 		add_cleanup (cleanup_unlock_gshadow, NULL);

 	}

@@ -352,7 +355,7 @@ static void open_files (void)

 	if (gr_open (O_CREAT | O_RDWR) == 0) {

 		fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());

 		SYSLOG ((LOG_WARN, "cannot open %s", gr_dbname ()));

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef	SHADOWGRP

@@ -362,7 +365,7 @@ static void open_files (void)

 			         _("%s: cannot open %s\n"),

 			         Prog, sgr_dbname ());

 			SYSLOG ((LOG_WARN, "cannot open %s", sgr_dbname ()));

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 	}

 #endif				/* SHADOWGRP */

@@ -495,7 +498,7 @@ static void check_flags (void)

 		fprintf (stderr,

 		         _("%s: group '%s' already exists\n"),

 		         Prog, group_name);

-		exit (E_NAME_IN_USE);

+		fail_exit (E_NAME_IN_USE);

 	}

 	if (gflg && (prefix_getgrgid (group_id) != NULL)) {

@@ -514,7 +517,7 @@ static void check_flags (void)

 			fprintf (stderr,

 			         _("%s: GID '%lu' already exists\n"),

 			         Prog, (unsigned long int) group_id);

-			exit (E_GID_IN_USE);

+			fail_exit (E_GID_IN_USE);

 		}

 	}

 }

@@ -542,7 +545,7 @@ static void check_perms (void)

 		fprintf (stderr,

 		         _("%s: Cannot determine your user name.\n"),

 		         Prog);

-		exit (1);

+		fail_exit (1);

 	}

 	retval = pam_start ("groupadd", pampw->pw_name, &conv, &pamh);

@@ -562,7 +565,7 @@ static void check_perms (void)

 		if (NULL != pamh) {

 			(void) pam_end (pamh, retval);

 		}

-		exit (1);

+		fail_exit (1);

 	}

 	(void) pam_end (pamh, retval);

 #endif				/* USE_PAM */

@@ -595,7 +598,7 @@ int main (int argc, char **argv)

 		fprintf (stderr,

 		         _("%s: Cannot setup cleanup service.\n"),

 		         Prog);

-		exit (1);

+		fail_exit (1);

 	}

 	/*

@@ -617,7 +620,7 @@ int main (int argc, char **argv)

 	if (!gflg) {

 		if (find_new_gid (rflg, &group_id, NULL) < 0) {

-			exit (E_GID_IN_USE);

+			fail_exit (E_GID_IN_USE);

 		}

 	}

diff -up shadow-4.6/src/groupdel.c.audit-update shadow-4.6/src/groupdel.c

--- shadow-4.6/src/groupdel.c.audit-update	2018-04-29 18:42:37.000000000 +0200

+++ shadow-4.6/src/groupdel.c	2018-05-28 15:01:09.914717585 +0200

@@ -105,6 +105,15 @@ static /*@noreturn@*/void usage (int sta

 	exit (status);

 }

+static void fail_exit(int status)

+{

+#ifdef WITH_AUDIT

+	audit_logger(AUDIT_GRP_MGMT, Prog, "delete-group", group_name,

+                        AUDIT_NO_ID, SHADOW_AUDIT_FAILURE);

+#endif

+	exit (status);

+}

+

 /*

  * grp_update - update group file entries

  *

@@ -131,7 +140,7 @@ static void grp_update (void)

 		fprintf (stderr,

 		         _("%s: cannot remove entry '%s' from %s\n"),

 		         Prog, group_name, gr_dbname ());

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef	SHADOWGRP

@@ -143,7 +152,7 @@ static void grp_update (void)

 			fprintf (stderr,

 			         _("%s: cannot remove entry '%s' from %s\n"),

 			         Prog, group_name, sgr_dbname ());

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 	}

 #endif				/* SHADOWGRP */

@@ -162,12 +171,12 @@ static void close_files (void)

 		fprintf (stderr,

 		         _("%s: failure while writing changes to %s\n"),

 		         Prog, gr_dbname ());

-		exit (E_GRP_UPDATE);

+		fail_exit (E_GRP_UPDATE);

 	}

 #ifdef WITH_AUDIT

 	audit_logger (AUDIT_DEL_GROUP, Prog,

-	              "removing group from /etc/group",

+	              "delete-group",

 	              group_name, (unsigned int) group_id,

 	              SHADOW_AUDIT_SUCCESS);

 #endif

@@ -187,12 +196,12 @@ static void close_files (void)

 			fprintf (stderr,

 			         _("%s: failure while writing changes to %s\n"),

 			         Prog, sgr_dbname ());

-			exit (E_GRP_UPDATE);

+			fail_exit (E_GRP_UPDATE);

 		}

 #ifdef WITH_AUDIT

-		audit_logger (AUDIT_DEL_GROUP, Prog,

-		              "removing group from /etc/gshadow",

+		audit_logger (AUDIT_GRP_MGMT, Prog,

+		              "delete-shadow-group",

 		              group_name, (unsigned int) group_id,

 		              SHADOW_AUDIT_SUCCESS);