Re: Recording user commands (from RE: Linux-audit Digest, Vol 31, Issue 12)
On Friday, April 27 2007 4:05:28 pm Taylor_Tad(a)emc.com wrote:
While a little more verbose than one might like, couldn't you
audit
exec() system calls? That would certainly capture all the commands
issued from a shell.
I believe that would miss all of the shell built-in commands though, wouldn't
it? Not sure if we would care, but you can do some interesting things with
the built-ins ... (although maybe you could capture that through additional
audit watches/syscalls/etc.)
--
paul moore
linux security @ hp