SF.net SVN: logwatch:[259] trunk

Revision: 259
          http://sourceforge.net/p/logwatch/code/259
Author:   opoplawski
Date:     2014-10-06 15:40:43 +0000 (Mon, 06 Oct 2014)
Log Message:
-----------
[sudo] Add the ability to ignore certain command runs

Modified Paths:
--------------
    trunk/conf/services/sudo.conf
    trunk/scripts/services/sudo

Modified: trunk/conf/services/sudo.conf
===================================================================
--- trunk/conf/services/sudo.conf	2014-09-29 09:44:30 UTC (rev 258)
+++ trunk/conf/services/sudo.conf	2014-10-06 15:40:43 UTC (rev 259)
@@ -1,7 +1,3 @@
-###########################################################################
-# $Id$
-###########################################################################
-
 # You can put comments anywhere you want to.  They are effective for the
 # rest of the line.
 
@@ -25,12 +21,10 @@
 # generated at low detail level
 $command_run_threshold = 0
 
-########################################################
-# This was written and is maintained by:
-#    Erik Ogan <erik-WYt22+s/[email protected]>
-#
-# Please send all comments, suggestions, bug reports,
-#    etc, to [email protected]
-########################################################
+# List of commands to ignore.  Format is a comma separated list of:
+#  from_user;tu_user;command
+# from_user can be ANY to match any user
+# command is a regular expression
+# $ignore_commands =
 
 # vi: shiftwidth=3 tabstop=3 et

Modified: trunk/scripts/services/sudo
===================================================================
--- trunk/scripts/services/sudo	2014-09-29 09:44:30 UTC (rev 258)
+++ trunk/scripts/services/sudo	2014-10-06 15:40:43 UTC (rev 259)
@@ -55,12 +55,21 @@
 my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
 # maximum number of commands user ran to display at low detail
 my $CmdsThresh = $ENV{'command_run_threshold'} || 0;
+my %IgnoreCmds;
 
 my ($user, $error, $tty, $dir, $euser, $cmd, $args);
 my (%ConFailed);
 my $contlines = 0;
 my $argsprinted = 0;
 
+if (defined($ENV{'ignore_commands'})) {
+   foreach my $entry (split(',',$ENV{'ignore_commands'})) {
+      $entry =~ s/['"]//g;
+      my ($from_user,$to_user,$cmd) = split(';',$entry);
+      push(@{$IgnoreCmds{$from_user}{$to_user}},$cmd);
+   }
+}
+
 while (defined(my $ThisLine = <STDIN>)) {
    if ($ThisLine =~ /pam_unix\(sudo:auth\): authentication failure; logname=\S* uid=[0-9]* euid=[0-9]* tty=\S* ruser=\S* rhost=\S*  user=\S*/
       )
@@ -74,6 +83,8 @@
    } elsif ($ThisLine =~ /(.+): conversation failed/) {
      $ConFailed{$1}++;
    } elsif ( ($user, $error, $tty, $dir, $euser, $cmd, $args) = $ThisLine =~ m/^\s*(\S+) : (.*; )?TTY=(\S+) ; PWD=(.*?) ; USER=(\S+) ; COMMAND=(\S+)( ?.*)/) {
+      next if (defined($IgnoreCmds{$user}{$euser}) && $cmd =~ join("|",@{$IgnoreCmds{$user}{$euser}}));
+      next if (defined($IgnoreCmds{'ANY'}{$euser}) && $cmd =~ join("|",@{$IgnoreCmds{'ANY'}{$euser}}));
       push @{$byUser{$user}{$euser}}, [$error . $cmd,$args, $dir, $tty];
       $byUserSum{$user}{$euser}{$cmd} += 1;
    } elsif ( ($user,$euser) = $ThisLine =~ /^\s*(\S+) : no passwd entry for (\S+)\!$/) {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Slashdot TV.  Videos for Nerds.  Stuff that Matters.
http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk