From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: Recording user commands (from RE: Linux-audit Digest, Vol 31, Issue 12) Date: Fri, 27 Apr 2007 16:28:17 -0400 Message-ID: <200704271628.17906.paul.moore@hp.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l3RKSe9O030491 for ; Fri, 27 Apr 2007 16:28:40 -0400 Received: from atlrel6.hp.com (atlrel6.hp.com [156.153.255.205]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l3RKSVwh012815 for ; Fri, 27 Apr 2007 16:28:31 -0400 In-Reply-To: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Taylor_Tad@emc.com List-Id: linux-audit@redhat.com On Friday, April 27 2007 4:05:28 pm Taylor_Tad@emc.com wrote: > While a little more verbose than one might like, couldn't you audit > exec() system calls? That would certainly capture all the commands > issued from a shell. I believe that would miss all of the shell built-in commands though, wouldn't it? Not sure if we would care, but you can do some interesting things with the built-ins ... (although maybe you could capture that through additional audit watches/syscalls/etc.) -- paul moore linux security @ hp