Bug 792 - Add LOG_PID to openlog calls so that sudo includes PID in syslog messages
Add LOG_PID to openlog calls so that sudo includes PID in syslog messages
Status: RESOLVED FIXED
Product: Sudo
Classification: Unclassified
Component: Sudo
1.8.20
PC Linux
: low enhancement
Assigned To: Todd C. Miller
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-07-20 16:18 MDT by Hank Leininger
Modified: 2017-08-24 05:49 MDT (History)
0 users

See Also:


Attachments
Add LOG_PID to openlog calls (400 bytes, patch)
2017-07-20 16:18 MDT, Hank Leininger
Details | Diff
Patch to add syslog_pid sudoers option. (3.79 KB, patch)
2017-07-20 16:37 MDT, Todd C. Miller
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Hank Leininger 2017-07-20 16:18:44 MDT
Created attachment 496 [details]
Add LOG_PID to openlog calls

I would find it useful if syslogs generated by sudo included the PID.  This would help when analyzing logs from a busy server where there are multiple messages per sudo, such as when pam_unix logs session opened / session closed messages.

Attached is a trivial patch to pass LOG_PID on openlog.  It gives my desired behavior:

  Jul 20 16:52:35 foo sudo[31629]:   apache : TTY=unknown ; PWD=/var/bar/cgi ; USER=yada ; GROUP=yada ; COMMAND=/var/bar/cgi/baz.cgi
  Jul 20 16:52:35 foo sudo[31629]: pam_unix(sudo:session): session opened for user yada by (uid=0)
  Jul 20 16:52:36 foo sudo[31629]: pam_unix(sudo:session): session closed for user yada

_But_, I do not suggest it's actually ready for inclusion yet; this change shouldn't happen by surprise, as it changes a ~20+ year established behavior and would break existing regexes.

I think the thing to do is probably to introduce a sudo.conf option, defaulting to off, that enables this.  Then first distributions, and then individual sysadmins, can decide if/when they want the new behavior.

I did not implement that yet though, wanted to get feedback on the idea first.  Would you accept this change; does a sudo.conf knob sound like the right approach?

Thanks!
Comment 1 Todd C. Miller 2017-07-20 16:37:30 MDT
Created attachment 497 [details]
Patch to add syslog_pid sudoers option.
Comment 2 Todd C. Miller 2017-07-20 16:38:43 MDT
I agree, I've made the following commit:
https://www.sudo.ws/repos/sudo/rev/f4dc29b0052c

and attached a diff relative to sudo 1.8.20
Comment 3 Hank Leininger 2017-07-20 16:39:12 MDT
Awesome, thank you!
Comment 4 Todd C. Miller 2017-08-24 05:49:43 MDT
Sudo 1.8.21 is out now and contains the syslog_pid option.