linux – 家庭作业：如何使用bash shell记录审核流程？

我是linux的新手,对新手问题感到抱歉.
我有一个功课额外的信用问题,我试图做,但未能得到它.

Q. Write a security shell script that logs the following information
for every process: User ID,time started,time ended (0 if process is
still running),whether the process has tried to access a secure file
(stored as either yes or no) The log created is called
process_security_log where each of the above pieces of information is
stored on a separate line and each entry follows immediately (that is,
there are no blank lines). Write a shell script that will examine
this log and output the User ID of any process that is still running
that has tried to access a secure file.

我开始尝试捕获用户并回显它但失败了.

output=`ps -ef | grep [*]`
set -- $output
User=$1
echo $User

最佳答案

ps的输出既不充分又无法生成此问题所需的数据.

您需要像auditd,SELinux或直接内核黑客(即fork.c)这样的东西来在安全日志记录领域中远程执行任何操作.

更新

其他人提出了使用shell命令日志记录,ps和朋友(proc或sysfs)的建议.它们可能很有用,并且确实有它们的位置(显然).我认为不应该为此目的而依赖它们,特别是在教育背景下.

… whether the process has tried to access a secure file (stored as either yes or no)

似乎是其他答案忽略的那个.我坚持原来的答案,但丹尼尔指出,还有其他有趣的方法来装饰这些数据.

> systemtap
> pref
> LTTng

对于教育练习,这些工具将有助于提供更完整的答案.