Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 7 down vote favorite
2

I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a standard way to achieve this on Linux?

share|improve this question

1 Answer

up vote 4 down vote accepted

You can log all invocations of a specific executable (setuid or not) through the audit subsystem. The documentation is rather sparse; start with the auditctl man page, or perhaps this tutorial. Most recent distributions ship an auditd package. Install it and make sure the auditd daemon is running, then do

auditctl -A exit,always -F path=/path/to/executable -S execve

and watch the calls get logged in /var/log/audit/audit.log (or wherever your distribution has set this up).

share|improve this answer
I guess one could write a script to first get all SUID binaries with find and then use your solution for each one. Not elegant, but certainly doable. Thanks! – Kim May 11 '11 at 20:31
1  
@Kim: I think you can log all invocations of a setuid root binary by a not-root user by replacing -F path=… with -F euid=0 -F 'uid!=0' or something like it. I can't see a hook in the setxid code invoked by execve nor a specific setxid watch in the audit subsystem. Or, of course, you can log every execve and postprocess. – Gilles May 11 '11 at 20:41
Interesting. Never heard of this before. I wonder how widely used it is. Debian popcon doesn't have an entry for auditd. – Faheem Mitha May 12 '11 at 15:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.