|
我是linux的新手,对新手问题感到抱歉.
我有一个功课额外的信用问题,我试图做,但未能得到它.
Q. Write a security shell script that logs the following information
for every process: User ID,time started,time ended (0 if process is
still running),whether the process has tried to access a secure file
(stored as either yes or no) The log created is called
process_security_log where each of the above pieces of information is
stored on a separate line and each entry follows immediately (that is,
there are no blank lines). Write a shell script that will examine
this log and output the User ID of any process that is still running
that has tried to access a secure file.
我开始尝试捕获用户并回显它但失败了.
output=`ps -ef | grep [*]`
set -- $output
User=$1
echo $User
最佳答案
ps的输出既不充分又无法生成此问题所需的数据.
您需要像auditd,SELinux或直接内核黑客(即fork.c)这样的东西来在安全日志记录领域中远程执行任何操作.
更新
其他人提出了使用shell命令日志记录,ps和朋友(proc或sysfs)的建议.它们可能很有用,并且确实有它们的位置(显然).我认为不应该为此目的而依赖它们,特别是在教育背景下.
… whether the process has tried to access a secure file (stored as either yes or no)
似乎是其他答案忽略的那个.我坚持原来的答案,但丹尼尔指出,还有其他有趣的方法来装饰这些数据.
> systemtap
> pref
> LTTng
对于教育练习,这些工具将有助于提供更完整的答案. （编辑：4S站长网）
【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!
|
