sudo: support for group change
Wojciech Górski <[email protected]> Sun, 2 Oct 2016 00:49:56 +0200
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Hello, running sudo with the '-g' switch (set primary group) makes the log entry look slightly different, causing logwatch to report unmatched entries. Attached patch matches these lines and outputs them with the group suffix. For example, running 'sudo -g root command' as user 'example', will output: example => example:root ----------------------- command - x Times(s). Note that appending the group name is done after checking the ignored command list - adapt to your liking if you think this is wrong. Regards, Wojciech Górski ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Logwatch-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/logwatch-devel
sudo.patch
(text/x-patch, 1.3 KB)
--- sudo.orig 2016-10-02 00:16:29.261631667 +0200
+++ sudo 2016-10-02 00:36:07.053566666 +0200
@@ -57,7 +57,7 @@
my $CmdsThresh = $ENV{'command_run_threshold'} || 0;
my %IgnoreCmds;
-my ($user, $error, $tty, $dir, $euser, $cmd, $args);
+my ($user, $error, $tty, $dir, $euser, $egroup, $cmd, $args);
my (%ConFailed);
my $contlines = 0;
my $argsprinted = 0;
@@ -84,9 +84,12 @@
# Ignore
} elsif ($ThisLine =~ /(.+): conversation failed/) {
$ConFailed{$1}++;
- } elsif ( ($user, $error, $tty, $dir, $euser, $cmd, $args) = $ThisLine =~ m/^\s*(\S+) : (.*; )?TTY=(\S+) ; PWD=(.*?) ; USER=(\S+) ; COMMAND=(\S+)( ?.*)/) {
+ } elsif ( ($user, $error, $tty, $dir, $euser, $egroup, $cmd, $args) = $ThisLine =~ m/^\s*(\S+) : (.*; )?TTY=(\S+) ; PWD=(.*?) ; USER=(\S+) ;(?: GROUP=(\S+) ;)? COMMAND=(\S+)( ?.*)/) {
next if (defined($IgnoreCmds{$user}{$euser}) && $cmd =~ join("|",@{$IgnoreCmds{$user}{$euser}}));
next if (defined($IgnoreCmds{'any'}{$euser}) && $cmd =~ join("|",@{$IgnoreCmds{'any'}{$euser}}));
+ if ($egroup) {
+ $euser .= ":${egroup}";
+ }
push @{$byUser{$user}{$euser}}, [$error . $cmd, $args, $dir, $tty];
$byUserSum{$user}{$euser}{$cmd} += 1;
} elsif ( ($user,$euser) = $ThisLine =~ /^\s*(\S+) : no passwd entry for (\S+)\!$/) {