Detecting sudo use without logs

Question

Is there any way to positively identify that sudo is being used to execute a command other than to identify the logs? I phrase this in the present tense because I would like to make a command fail if it detects that someone else is using sudo to change users to run a command.

I've been looking at using ps to trace parent process IDs, but it doesn't appear to be reliable with symbolic links.

Answer 1

You can play around with the environ file under /proc/$pid. This contains the environment of the process with PID $pid and for commands launched with sudo, that file should contain the SUDO_USER variable. So you can look for all processes being run as root whose environ files contain the string SUDO_USER=. Like this (note that the command below needs to run as root to have access to the environ files):

# pgrep -u root | 
  while read pid; do 
     if grep -aq SUDO_USER= /proc/$pid/environ; then
       printf "PID %s was launched via sudo\n" "$pid"
     fi
done

On my system, this looks like:

# pgrep -u root | while read pid; do if grep -aq SUDO_USER= /proc/$pid/environ; then printf "PID %s was launched via sudo\n" "$pid"; fi; done
PID 70650 was launched via sudo
PID 561158 was launched via sudo
PID 1841478 was launched via sudo
PID 2923409 was launched via sudo
PID 2925264 was launched via sudo
PID 2968491 was launched via sudo
PID 2974216 was launched via sudo

Note that this will also catch cases where a user has started a shell with sudo -i or even the horrible sudo su. Any commands launched in such shells will inherit the various SUDO_* variable from the parent.