https://bugzilla.redhat.com/show_bug.cgi?id=1676961
--- Comment #8 from Sumit Bose <sbose(a)redhat.com> ---
Hi,
thanks for explaining your use case. I would recommend to use auditd do record
which user is doing what with sudo, see e.g.
https://sudoedit.com/log-sudo-with-auditd/.
As an example. If I set
sudo auditctl -a exit,always -F arch=b64 -F euid=0 -F
path=/usr/sbin/sss_cache -S execve -k sudo_audit
and a user with UID 1000 then calls
date ; sudo sss_cache -E
Thu Feb 25 14:59:56 UTC 2021
then the administrator can later call
sudo ausearch -ua vagrant -k sudo_audit -x /usr/sbin/sss_cache
time->Thu Feb 25 14:59:56 2021
type=PROCTITLE msg=audit(1614265196.620:5737):
proctitle=7373735F6361636865002D45
type=PATH msg=audit(1614265196.620:5737): item=1
name="/lib64/ld-linux-x86-64.so.2" inode=153852 dev=fd:01 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0
cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1614265196.620:5737): item=0 name="/sbin/sss_cache"
inode=606020 dev=fd:01 mode=0104555 ouid=0 ogid=0 rdev=00:00
obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0
cap_fver=0 cap_frootid=0
type=CWD msg=audit(1614265196.620:5737): cwd="/home/vagrant"
type=EXECVE msg=audit(1614265196.620:5737): argc=2 a0="sss_cache"
a1="-E"
type=SYSCALL msg=audit(1614265196.620:5737): arch=c000003e syscall=59
success=yes exit=0 a0=561aea8a88b8 a1=561aea8b0178 a2=561aea8c7160 a3=1 items=2
ppid=59080 pid=59082 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="sss_cache" exe="/usr/sbin/sss_cache"
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="sudo_audit"
So you get full path of the command with options, execution time and
'auid=1000'
If you prefer to do this manually in scripts you can check /proc/self/loginuid,
e.g.
sudo cat /proc/self/loginuid
1000
I hope one of this will work for you.
bye,
Sumit
--
You are receiving this mail because:
You are the assignee for the bug.