[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Recording user commands (from RE: Linux-audit Digest, Vol 31, Issue 12)



On Friday, April 27 2007 4:05:28 pm Taylor_Tad emc com wrote:
> While a little more verbose than one might like, couldn't you audit
> exec() system calls?  That would certainly capture all the commands
> issued from a shell.

I believe that would miss all of the shell built-in commands though, wouldn't 
it?  Not sure if we would care, but you can do some interesting things with 
the built-ins ... (although maybe you could capture that through additional 
audit watches/syscalls/etc.)

-- 
paul moore
linux security @ hp


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]