From owner-freebsd-security  Mon Jan 17  2:58:46 2000
Delivered-To: freebsd-security@freebsd.org
Received: from axl.noc.iafrica.com (axl.noc.iafrica.com [196.31.1.175])
	by hub.freebsd.org (Postfix) with ESMTP id EFE2F14BF3
	for <freebsd-security@freebsd.org>; Mon, 17 Jan 2000 02:58:38 -0800 (PST)
	(envelope-from sheldonh@axl.noc.iafrica.com)
Received: from sheldonh (helo=axl.noc.iafrica.com)
	by axl.noc.iafrica.com with local-esmtp (Exim 3.11 #1)
	id 12A9rW-00082G-00; Mon, 17 Jan 2000 12:58:18 +0200
From: Sheldon Hearn <sheldonh@uunet.co.za>
To: Omachonu Ogali <oogali@intranova.net>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: Parent Logging Patch for sh(1) 
In-reply-to: Your message of "Sun, 16 Jan 2000 13:04:52 EST."
             <Pine.BSF.4.10.10001161303270.78637-100000@hydrant.intranova.net> 
Date: Mon, 17 Jan 2000 12:58:18 +0200
Message-ID: <30891.948106698@axl.noc.iafrica.com>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org



On Sun, 16 Jan 2000 13:04:52 EST, Omachonu Ogali wrote:

> After applied, sh(1) will log the parent process ID and name that executed
> it into syslog.

Assuming you're doing this to provide security-related information,
consider Andrzej Bialecki's spy(4) interface, available from:

	http://www.freebsd.org/~abial/spy-0.1.tgz

I think you'll find that it does a much more comprehensive job of what
you're trying to do.

You can pick up a copy of the manpage at:

	http://www.freebsd.org/~sheldonh/spy.4

Ciao,
Sheldon.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message