Bug 1288653
Summary: | [RFE] Add USER_CMD audit event to cronie | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Steve Grubb <sgrubb> |
Component: | cronie | Assignee: | Ondřej Pohořelský <opohorel> |
Status: | NEW --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | low | ||
Version: | rawhide | CC: | mmaslano, tmraz |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | Type: | Bug | |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Steve Grubb
2015-12-04 21:33:28 UTC
Note that sudo runs the command with elevated privileges usually root. In the cron job case it is run with the same privileges as the user that created the crontab. Are we sure we need this auditing? I think we would want the event logged before changing to the user ID associated with the job. Somewhere in the area that the pam stack gets executed and after setting the loginuid seems like the logical place to me. But yes, we could really use the information because there is no other good way to get at it. But if I am running some unprivileged commands via bash there is no auditing either. If you are running unprivileged commands using a shell while logged in, we can get TTY keystrokes. |