Bugzilla – Bug 966
log diffs on visudo invocation
Last modified: 2021-02-25 12:20:13 MST
This is a forwarded issue from Martin F. Krafft from the Debian BTS: It would be awesome if visudo could put a diff of changes into /var/log/sudo. Should be trivial, since we have /etc/sudoers.tmp anyway, so when the editor finishes and the syntax check passed, something along the following logic would do: LOGDIR=/var/log/sudo TIMESTAMP=$(/bin/date +'%Y.%m.%d.%H.%M.%S') LOGNAME=${SUDO_USER:-$USER} # include pts somehow? LOGFILE=${LOGDIR}/lsh.${TIMESTAMP}.${LOGNAME} # non-racy check for logfile existence diff -abBdEtuw /etc/sudoers /etc/sudoers.tmp > $LOGFILE
Integration with a revision control system (e.g. git) might be a better solution.
Putting sudoers under version control is too big a hammer for the issue. Generating a diff and dumping it to a file or syslog is a pretty small change and this way all systems having sudo installed will profit. Have to agree with Martin here.