On 12/18/2012 08:20 PM, Tim Daneliuk wrote:
On 12/18/2012 08:03 PM, Devin Teske wrote:
On Dec 18, 2012, at 5:43 PM, Tim Daneliuk wrote:
On 12/18/2012 07:33 PM, Devin Teske wrote:
On Dec 18, 2012, at 5:18 PM, Tim Daneliuk wrote:
One further question, if I may. If I do this:
sudo su -
Will log_input record everything I do once I've been promoted to
root? I ask because my initial experiments seem to show that all
that's getting recorded is the content of the sudo command itself,
not the subsequent actions…
Correct, sudo is blind to the actions performed once the command requested is executed
(in this case, "su" and subsequently a shell followed by more actions).
Actually, I just tried this with both log_input and log_output options enabled.
It seems that it *can* see into the promoted shell with a few caveats:
- Command output is logged immediately, but command inputs appear to only
be written to the log when you exit the promoted shell. This may be
not quite right - there may have not been enough input to cause a
write flush to the log.
- The logging seems to be able to see into a spawned subshell, but
I don't think it can see input/output if you, say, kick off an xterm.
What about if you do "sudo vim" and then type ":sh" ?
Yep, I just tried that too. It catches that. It also catches
the in/output of subshells - like, say, kicking off sh interactively.
Similarly, if you're running text-based emacs, it catches the output
of spawning to a shell from there and doing things.
The only restriction I have run into so far, it that - for obvious
reasons - sudo cannot see into what you're doing if you kick off
an X application like xterm or graphical emacs, for instance.
I should clarify that I tested this not on FreeBSD but on a Mint Linux
desktop I had handy. I would expect the same behavior everywhere, though,
since sudo itself is reasonably portable...
--
----------------------------------------------------------------------------
Tim Daneliuk [email protected]
PGP Key: http://www.tundraware.com/PGP/
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[email protected]"
