summaryrefslogtreecommitdiff
path: root/config.h.in
diff options
context:
space:
mode:
authorStephen Hemminger <stephen.hemminger@vyatta.com>2010-04-05 09:48:26 -0700
committerStephen Hemminger <stephen.hemminger@vyatta.com>2010-04-05 09:48:26 -0700
commitc6a8e270ab694c2291216b8c554c2f5f9dcf0fd0 (patch)
treed964a27ef6a135377ef09358e9414af5ac747ca4 /config.h.in
parent8c105a156601216de19ff17fca1ab34fe798f1c5 (diff)
downloadvyatta-bash-c6a8e270ab694c2291216b8c554c2f5f9dcf0fd0.tar.gz
vyatta-bash-c6a8e270ab694c2291216b8c554c2f5f9dcf0fd0.zip
Add auditing support to bash
This is based on earlier (unaccepted) patch to add auditing support which wasd done by Steve Grubb at Redhat. This patch depends on audit 1.4 to provide a logging function. The resulting audit message looks like this: time->Tue Jan 30 18:23:45 2007 type=USER_CMD msg=audit(1170199425.793:143): user pid=22862 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='cwd=2F726F6F742F7465737420646972 cmd=6C73202D6C (terminal=tty1 res=success)' Which translates to: type=USER_CMD msg=audit(01/30/2007 18:23:45.793:143) : user pid=22862 uid=root auid=root subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='cwd=/root/test dir cmd=ls -l (terminal=tty1 res=success)' This patch causes bash to log all command line arguments when the shell is started as aubash or "bash --audit". The preferred methos is to make a symlink frp, bash to aubash and then add aubash to /etc/shells. Then you can change root's shell to aubash.
Diffstat (limited to 'config.h.in')
-rw-r--r--config.h.in5
1 files changed, 5 insertions, 0 deletions
diff --git a/config.h.in b/config.h.in
index 7fde761..46d281b 100644
--- a/config.h.in
+++ b/config.h.in
@@ -81,6 +81,11 @@
flag. */
#undef RESTRICTED_SHELL
+/* Define AUDIT_SHELL if you want the generated shell to audit all
+ actions performed by root account. The shell thus generated can become
+ audited by being run with the name "aubash". */
+#undef AUDIT_SHELL
+
/* Define DISABLED_BUILTINS if you want "builtin foo" to always run the
shell builtin "foo", even if it has been disabled with "enable -n foo". */
#undef DISABLED_BUILTINS