Date: Tue, 25 Feb 1997 09:38:09 +0800 (WST) From: Adrian Chadd <adrian@cougar.aceonline.com.au> To: Marc Slemko <marcs@znep.com> Cc: hackers@freebsd.org, auditors@freebsd.org Subject: Re: disallow setuid root shells? Message-ID: <Pine.LNX.3.93.970225093341.22261A-100000@cougar.aceonline.com.au> In-Reply-To: <Pine.BSF.3.95.970224171452.14441E-100000@alive.znep.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 24 Feb 1997, Marc Slemko wrote: > > Btw - yes I know adduser isn't suid, sorry, I just woke up .. now I've had > > my coffee things are clearer. :) > > process accounting sortof does that: > > lastcomm: (after enabling process accounting, of course) > > passwd -S marcs ttyp1 0.09 secs Mon Feb 24 17:14 > > The S says used superuser privs. That is only a partial implementation, > though, since process accounting logs aren't the nicest to log remotely, > they contain a whole lot of other programs, and the S flag is only set if > something the process calls suser(); ie. something it calls ends up > resulting in suser being called by something. A lot can be done without > doing that. > > Process accounting may be something to start for that type of logging. > Ahh ok I'll take a look at that when I get home. I however like the idea of logging all setuid programs when they are run, and at the kernel level as well. The only problem I can see is with the size of the logs, but if people think its a worthwhile thing I might have a look at implementing something, again when I get home. Adrian.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.LNX.3.93.970225093341.22261A-100000>