|
Bugzilla – Full Text Bug Listing |
| Summary: | log diffs on visudo invocation | ||
|---|---|---|---|
| Product: | Sudo | Reporter: | Marc Haber <mh+sudo-bugzilla> |
| Component: | Visudo | Assignee: | Todd C. Miller <Todd.Miller> |
| Status: | NEW --- | ||
| Severity: | enhancement | ||
| Priority: | low | ||
| Version: | 1.9.5 | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| URL: | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446361 | ||
Integration with a revision control system (e.g. git) might be a better solution. Putting sudoers under version control is too big a hammer for the issue. Generating a diff and dumping it to a file or syslog is a pretty small change and this way all systems having sudo installed will profit. Have to agree with Martin here. |
This is a forwarded issue from Martin F. Krafft from the Debian BTS: It would be awesome if visudo could put a diff of changes into /var/log/sudo. Should be trivial, since we have /etc/sudoers.tmp anyway, so when the editor finishes and the syntax check passed, something along the following logic would do: LOGDIR=/var/log/sudo TIMESTAMP=$(/bin/date +'%Y.%m.%d.%H.%M.%S') LOGNAME=${SUDO_USER:-$USER} # include pts somehow? LOGFILE=${LOGDIR}/lsh.${TIMESTAMP}.${LOGNAME} # non-racy check for logfile existence diff -abBdEtuw /etc/sudoers /etc/sudoers.tmp > $LOGFILE