My question: Is there a way to record all commands who execute a suid programme? Like what .bash_history do, but only the setuid programmes.
If you have particular commands in mind you can configure
auditd to record all
execve uses with that binary:
auditctl -a exit,always -S execve -F path=/usr/bin/passwd
Then you can use ausearch to look for those invocations:
ausearch -x /usr/bin/passwd