How to see PPID of a sudo call?

Hewson · 02-12-2010, 11:43 AM

I need to know what deamon process is using sudo.

I tried writing a quick bash wrapper:

Code:

#!/bin/bash
thedate=`date`
echo -e "$thedate\t$PPID is attempting to use sudo" >> /var/log/secure
/usr/bin/real_sudo "$@"

Code:

[root@cable ~: 09:37:42]# ls -l ./sudo_wrapper
---s--x--x 1 root root 122 Feb 12 09:27 ./sudo_wrapper*

Then setting it executable, owned by root, and turning the sticky bit on.

When I tried using this script as a normal user I just get permission denied.

Any ideas?

unSpawn · 02-12-2010, 12:48 PM

Quote:

Originally Posted by Hewson

echo -e "$thedate\t$PPID is attempting to use sudo" >> /var/log/secure

Do that with /var/log/secure and fsck up the syslog timestamps: use 'logger' and provide the right facility and priority instead.

Quote:

Originally Posted by Hewson

setting it executable, owned by root, and turning the sticky bit on.

Setuid doesn't work with scripts.

Quote:

Originally Posted by Hewson

I need to know what deamon process is using sudo.

It all boils down to this: why?

The process replaces Sudo so AFAIK there's no way searching for it afterwards: you'll have to get in right before that. A script might work if your "daemon process" runs in a single-user-per-group way, then maybe you could search the process space for that user: those processes won't share UID (obviously) but they'll share SID. Better would be to get in right before that but using syscall logging. For instance Auditd will show the PID of the resulting process and the original UID. I hope that's enough leads to try 'n play "connect the dots".

Hewson · 02-12-2010, 01:52 PM

Quote:

Originally Posted by unSpawn

Do that with /var/log/secure and fsck up the syslog timestamps: use 'logger' and provide the right facility and priority instead.

It was mostly a hack

Quote:

Originally Posted by unSpawn

Setuid doesn't work with scripts.

ya, apparently the kernel ignores setuid for scripts for security reasons.

Quote:

Originally Posted by unSpawn

It all boils down to this: why?

I'm on a dev machine and was trying to figure out what process was misbehaving.

I just replaced /usr/bin/sudo with my script, setting normal 755 permissions. This was good enough to figure out which process; Not really a working solution for anything longterm, but good enough for my needs. Thanks for the response.