Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 18 Dec 2012 20:20:57 -0600
From:      Tim Daneliuk <tundra@tundraware.com>
To:        FreeBSD Mailing List <freebsd-questions@freebsd.org>
Subject:   Re: Somewhat OT: Is Full Command Logging Possible?
Message-ID:  <50D12489.20507@tundraware.com>
In-Reply-To: <F8791D4C-8753-469D-8926-3A6B81E7AB51@fisglobal.com>
References:  <50BFD674.8000305@tundraware.com> <CADy1Ce5CCA4ExOok4DndA4C-MazbegZY1OKztCNqUZHGzLJgTA@mail.gmail.com> <50BFDD51.5000100@tundraware.com> <20689.4087.859208.619511@gromit.timing.com> <50D113C0.3020607@tundraware.com> <50D115D9.6090608@tundraware.com> <57543CB2-2C92-434A-959B-C1CF5FC01600@fisglobal.com> <50D11BC4.5080803@tundraware.com> <F8791D4C-8753-469D-8926-3A6B81E7AB51@fisglobal.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On 12/18/2012 08:03 PM, Devin Teske wrote:
>
> On Dec 18, 2012, at 5:43 PM, Tim Daneliuk wrote:
>
>> On 12/18/2012 07:33 PM, Devin Teske wrote:
>>>
>>> On Dec 18, 2012, at 5:18 PM, Tim Daneliuk wrote:
>>>
>>
>>>>>
>>>>
>>>> One further question, if I may.  If I do this:
>>>>
>>>>    sudo su -
>>>>
>>>> Will log_input record everything I do once I've been promoted to
>>>> root?  I ask because my initial experiments seem to show that all
>>>> that's getting recorded is the content of the sudo command itself,
>>>> not the subsequent actions…
>>>>
>>>
>>> Correct, sudo is blind to the actions performed once the command requested is executed (in this case, "su" and subsequently a shell followed by more actions).
>>>
>>
>> Actually, I just tried this with both log_input and log_output options enabled.
>> It seems that it *can* see into the promoted shell with a few caveats:
>>
>>   - Command output is logged immediately, but command inputs appear to only
>>     be written to the log when you exit the promoted shell.  This may be
>>     not quite right - there may have not been enough input to cause a
>>     write flush to the log.
>>
>>   - The logging seems to be able to see into a spawned subshell, but
>>     I don't think it can see input/output if you, say, kick off an xterm.
>>
>
> What about if you do "sudo vim" and then type ":sh" ?

Yep, I just tried that too.  It catches that.  It also catches
the in/output of subshells - like, say, kicking off sh interactively.
Similarly, if you're running text-based emacs, it catches the output
of spawning to a shell from there and doing things.

The only restriction I have run into so far, it that - for obvious
reasons - sudo cannot see into what you're doing if you kick off
an X application like xterm or graphical emacs, for instance.


>


-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?50D12489.20507>