linux - 作业 : How can I log processes for auditing using the bash shell?

Question

我是 linux 的新手，很抱歉新手提出问题。我有一个家庭作业加分题，我想做但没有得到它。

Q. Write a security shell script that logs the following information for every process: User ID, time started, time ended (0 if process is still running), whether the process has tried to access a secure file (stored as either yes or no) The log created is called process_security_log where each of the above pieces of information is stored on a separate line and each entry follows immediately (that is, there are no blank lines). Write a shell script that will examine this log and output the User ID of any process that is still running that has tried to access a secure file.

我开始尝试只捕获用户并回显它但失败了。

output=`ps -ef | grep [*]`
set -- $output
User=$1
echo $User

Answer 1

ps 的输出既不充分也不能产生本题所需的数据。

您需要诸如 auditd、SELinux 或直接内核 hack(即 fork.c)之类的东西才能在安全日志记录领域远程执行任何操作。

更新

其他人建议使用 shell 命令日志记录、ps 和 friend (proc 或 sysfs)。它们可能很有用，并且确实占有一席之地(显然)。我认为他们不应该被依赖用于此目的，尤其是在教育环境中。

... whether the process has tried to access a secure file (stored as either yes or no)

似乎是其他答案忽略的那个。我坚持我最初的回答，但正如 Daniel 指出的那样，还有其他有趣的方式来装饰这些数据。

• systemtap
• pref
• LTTng

对于教育练习，这些工具将有助于提供更完整的答案。