Re: pam_tty_audit icanon log switch
----- Original Message -----
Most commands are entered one line at a time and processed as
complete
lines in non-canonical mode. Commands that interactively require a
password, enter canonical mode to do this. This feature (icanon) can be
used to avoid logging passwords by audit while still logging the rest of
the command.
There was an earlier discussion about the correctness of using ICANON for this. Is ICANON
really the right variable?
AFAICT the seeings are used like this:
(cat) and other programs that just take standard input: ICANON && ECHO
(bash), (vi) and other interactive programs: !ICANON && !ECHO
password prompts: ICANON && !ECHO
and we want to exclude only password prompts.
Mirk