Somewhat OT: Is Full Command Logging Possible?
Tim Daneliuk
tundra at tundraware.com
Wed Dec 19 02:27:41 UTC 2012
On 12/18/2012 08:20 PM, Tim Daneliuk wrote:
> On 12/18/2012 08:03 PM, Devin Teske wrote:
>>
>> On Dec 18, 2012, at 5:43 PM, Tim Daneliuk wrote:
>>
>>> On 12/18/2012 07:33 PM, Devin Teske wrote:
>>>>
>>>> On Dec 18, 2012, at 5:18 PM, Tim Daneliuk wrote:
>>>>
>>>
>>>>>>
>>>>>
>>>>> One further question, if I may. If I do this:
>>>>>
>>>>> sudo su -
>>>>>
>>>>> Will log_input record everything I do once I've been promoted to
>>>>> root? I ask because my initial experiments seem to show that all
>>>>> that's getting recorded is the content of the sudo command itself,
>>>>> not the subsequent actions…
>>>>>
>>>>
>>>> Correct, sudo is blind to the actions performed once the command requested is executed (in this case, "su" and subsequently a shell followed by more actions).
>>>>
>>>
>>> Actually, I just tried this with both log_input and log_output options enabled.
>>> It seems that it *can* see into the promoted shell with a few caveats:
>>>
>>> - Command output is logged immediately, but command inputs appear to only
>>> be written to the log when you exit the promoted shell. This may be
>>> not quite right - there may have not been enough input to cause a
>>> write flush to the log.
>>>
>>> - The logging seems to be able to see into a spawned subshell, but
>>> I don't think it can see input/output if you, say, kick off an xterm.
>>>
>>
>> What about if you do "sudo vim" and then type ":sh" ?
>
> Yep, I just tried that too. It catches that. It also catches
> the in/output of subshells - like, say, kicking off sh interactively.
> Similarly, if you're running text-based emacs, it catches the output
> of spawning to a shell from there and doing things.
>
> The only restriction I have run into so far, it that - for obvious
> reasons - sudo cannot see into what you're doing if you kick off
> an X application like xterm or graphical emacs, for instance.
I should clarify that I tested this not on FreeBSD but on a Mint Linux
desktop I had handy. I would expect the same behavior everywhere, though,
since sudo itself is reasonably portable...
--
----------------------------------------------------------------------------
Tim Daneliuk tundra at tundraware.com
PGP Key: http://www.tundraware.com/PGP/
More information about the freebsd-questions
mailing list