Very Computer

I want to know if theres a way of getting all the stuff that user does on
the shell logged to a file which he/she cant access nor delete. something
like .bash_history just inaccessible to a user.

Quote:> I want to know if theres a way of getting all the stuff that user does on
> the shell logged to a file which he/she cant access nor delete. something
> like .bash_history just inaccessible to a user.

By virtue of the fact that the shell is running under the identity of the
logged in user, it's nearly impossible to make this happen.  The only
situation where it's possible is when the following conditions are met:

(1) You've modified the shell so that the user cannot turn off or redirect
the shell history file.  Under unpatched bash, turning history off is as
simple as "unset HISTFILE".

(2) The file ~user/.bash_history (or whichever) is either a pipe (ick) or a
file sitting on ext2 marked as append-only with chattr +a.  Only the
superuser can modify the ext2 special bits, and it's not permitted to
delete or overwrite an append-only file.  However, this only works under
Linux and only if the /home partition is ext2.

(3) The user cannot change his/her shell to a different program.

(4) The user isn't smart enough to compile his/her own copy of bash (or any
other shell program), install it with prefix ~user, then alter his/her
~/.bash_login to do an "exec ~/bin/bash".

The only way to do this in a way that is guaranteed undefeatable by
non-root users is to perform some sort of kernel-level auditing on calls to
the sys_execve function.

--
Chronos Tachyon
Guardian of Eristic Paraphernalia
Gatekeeper of the Region of Thud
[Reply instructions:  My real domain is "echo <address> | cut -d. -f6,7"]

Well, sort of.

Quote:> (2) The file ~user/.bash_history (or whichever) is either a pipe (ick) or a
> file sitting on ext2 marked as append-only with chattr +a.  Only the
> superuser can modify the ext2 special bits, and it's not permitted to
> delete or overwrite an append-only file.  However, this only works under
> Linux and only if the /home partition is ext2.

Actually, they cannot set the A attribute. Regular users can set/unset
some others, such as S.

Quote:> (3) The user cannot change his/her shell to a different program.

Which includes the inability to use the shell escape feature of any
program to spawn a subshell which is different than the login
shell. This is impossible to enforce on most systems.

It also precludes installing anything written in an interpreted
language. Otherwise, the user can run the interpreter as a "shell"
executing commands that way.

Quote:> (4) The user isn't smart enough to compile his/her own copy of bash (or any
> other shell program), install it with prefix ~user, then alter his/her
> ~/.bash_login to do an "exec ~/bin/bash".

Yes, which precludes installing a compiler in addition to an interpreter.

Quote:> The only way to do this in a way that is guaranteed undefeatable by
> non-root users is to perform some sort of kernel-level auditing on calls to
> the sys_execve function.

You actually need to do a bit more than that, but I'm sure there's a
C2 auditing patch for the kernel somewhere. It may be that the process
accounting options are a workable option for the OP too.

Of course, one problem is you'd have to know what you're
accounting. If you let users build software in their home directory,
you'll never really know what they're running without looking. There's
nothing to keep a really determined user from calling his software
"gimp" or worse, puttting his binary inside the gimp source tree
masquerading as a fresh-built gimp.

--

  [Snip]

Quote:

>> (2) The file ~user/.bash_history (or whichever) is either a pipe (ick) or
>> a
>> file sitting on ext2 marked as append-only with chattr +a.  Only the
>> superuser can modify the ext2 special bits, and it's not permitted to
>> delete or overwrite an append-only file.  However, this only works under
>> Linux and only if the /home partition is ext2.

> Actually, they cannot set the A attribute. Regular users can set/unset
> some others, such as S.

Oops, you're right, I checked chattr(1) and the only root-only attributes
are "a"ppend and "i"mmutable.

--
Chronos Tachyon
Guardian of Eristic Paraphernalia
Gatekeeper of the Region of Thud
[Reply instructions:  My real domain is "echo <address> | cut -d. -f6,7"]