Recording user commands (from RE: Linux-audit Digest, Vol 31, Issue 12)

[Paul Moore]

On Friday, April 27 2007 4:05:28 pm Taylor_Tad at emc.com wrote:
> While a little more verbose than one might like, couldn't you audit
> exec() system calls?  That would certainly capture all the commands
> issued from a shell.

I believe that would miss all of the shell built-in commands though, wouldn't 
it?  Not sure if we would care, but you can do some interesting things with 
the built-ins ... (although maybe you could capture that through additional 
audit watches/syscalls/etc.)

-- 
paul moore
linux security @ hp