From: Paul Moore <paul.moore@hp.com>
To: linux-audit@redhat.com
Cc: Taylor_Tad@emc.com
Subject: Re: Recording user commands (from RE: Linux-audit Digest, Vol 31, Issue 12)
Date: Fri, 27 Apr 2007 16:28:17 -0400 [thread overview]
Message-ID: <200704271628.17906.paul.moore@hp.com> (raw)
In-Reply-To: <CEF7DE8455A91D42A0435A429564032904FFA874@CORPUSMX40B.corp.emc.com>
On Friday, April 27 2007 4:05:28 pm Taylor_Tad@emc.com wrote:
> While a little more verbose than one might like, couldn't you audit
> exec() system calls? That would certainly capture all the commands
> issued from a shell.
I believe that would miss all of the shell built-in commands though, wouldn't
it? Not sure if we would care, but you can do some interesting things with
the built-ins ... (although maybe you could capture that through additional
audit watches/syscalls/etc.)
--
paul moore
linux security @ hp
next prev parent reply other threads:[~2007-04-27 20:28 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20070426160026.DFC3B73253@hormel.redhat.com>
2007-04-27 20:05 ` Recording user commands (from RE: Linux-audit Digest, Vol 31, Issue 12) Taylor_Tad
2007-04-27 20:10 ` Steve Grubb
2007-04-27 20:28 ` Paul Moore [this message]
2007-04-27 21:38 ` Valdis.Kletnieks
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200704271628.17906.paul.moore@hp.com \
--to=paul.moore@hp.com \
--cc=Taylor_Tad@emc.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.