Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a standard way to achieve this on Linux?

share|improve this question
up vote 5 down vote accepted

You can log all invocations of a specific executable (setuid or not) through the audit subsystem. The documentation is rather sparse; start with the auditctl man page, or perhaps this tutorial. Most recent distributions ship an auditd package. Install it and make sure the auditd daemon is running, then do

auditctl -A exit,always -F path=/path/to/executable -S execve

and watch the calls get logged in /var/log/audit/audit.log (or wherever your distribution has set this up).

share|improve this answer
I guess one could write a script to first get all SUID binaries with find and then use your solution for each one. Not elegant, but certainly doable. Thanks! – Kim May 11 '11 at 20:31
@Kim: I think you can log all invocations of a setuid root binary by a not-root user by replacing -F path=… with -F euid=0 -F 'uid!=0' or something like it. I can't see a hook in the setxid code invoked by execve nor a specific setxid watch in the audit subsystem. Or, of course, you can log every execve and postprocess. – Gilles May 11 '11 at 20:41
Interesting. Never heard of this before. I wonder how widely used it is. Debian popcon doesn't have an entry for auditd. – Faheem Mitha May 12 '11 at 15:35
find command to list all the SUID files: find / -xdev \( -perm -4000 \) -type f -print – user43301 Jul 18 '13 at 6:34
@FaheemMitha It has an popcon entry: qa.debian.org/popcon-graph.php?packages=auditd – jofel Jul 18 '13 at 16:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.