On Friday, April 27 2007 4:05:28 pm [EMAIL PROTECTED] wrote: > While a little more verbose than one might like, couldn't you audit > exec() system calls? That would certainly capture all the commands > issued from a shell.
I believe that would miss all of the shell built-in commands though, wouldn't it? Not sure if we would care, but you can do some interesting things with the built-ins ... (although maybe you could capture that through additional audit watches/syscalls/etc.) -- paul moore linux security @ hp -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
