Date: Thu, 26 Jul 2012 20:27:20 +0000 (UTC) From: jb <jb.1234abcd@gmail.com> To: freebsd-questions@freebsd.org Subject: Re: Security - logging of user commands Message-ID: <loom.20120726T221857-670@post.gmane.org> References: <500FDCE4.8060607@my.gd> <loom.20120725T143820-718@post.gmane.org> <500FF037.4020302@my.gd> <loom.20120725T180820-933@post.gmane.org> <50111AB1.7060205@my.gd>
next in thread | previous in thread | raw e-mail | index | archive | help
Damien Fleuriot <ml <at> my.gd> writes:
> ...
> Might anyone confirm the issue ?
>
> The above is true for 8.1-RELEASE, 8-STABLE , 9-STABLE with snoopy being
> at version 1.8.0 on all of them.
$ uname -r
9.0-RELEASE-p3
$ man ldconfig
...
Filenames must conform to the lib*.so.[0-9] pattern in order to
be added to the hints file.
...
FILES
/var/run/ld.so.hints Standard hints file for the a.out dynamic
linker.
/var/run/ld-elf.so.hints Standard hints file for the ELF dynamic
linker.
/etc/ld.so.conf Conventional configuration file containing
directory names for invocations with -aout.
/etc/ld-elf.so.conf Conventional configuration file containing
directory names for invocations with -elf.
/var/run/ld-elf32.so.hints
/var/run/ld32.so.hints Conventional configuration files containing
directory names for invocations with -32.
/etc/objformat Determines whether -aout or -elf is the
default. If present, it must consist of a
single line containing either
`OBJFORMAT=aout' or `OBJFORMAT=elf'.
...
$
# ls -al /usr/local/lib/libsnoopy.so*
lrwxr-xr-x 1 root wheel 14 Jul 26 20:43 /usr/local/lib/libsnoopy.so ->
libsnoopy.so.1
-r-xr-xr-x 1 root wheel 4824 Jul 26 20:07 /usr/local/lib/libsnoopy.so.1
$ grep ldconfig /etc/defaults/rc.conf
...
ldconfig_paths=... /usr/local/lib ...
...
# /etc/rc.d/ldconfig start
...
ldconfig_start()
...
for i in ${ldconfig_paths} /etc/ld-elf.so.conf; do
if [ -r "${i}" ]; then
_LDC="${_LDC} ${i}"
fi
done
check_startmsgs && echo 'ELF ldconfig path:' ${_LDC}
${ldconfig} -elf ${_ins} ${_LDC}
...
$ ldconfig -r
/var/run/ld-elf.so.hints:
search directories:
/lib:/usr/lib:/usr/lib/compat:/usr/local/lib:/usr/local/lib/event2:/usr/local
/lib/gcc46:/usr/local/lib/graphviz:/usr/local/lib/libxul:/usr/local/lib/nss:
/usr/local/lib/pth:/usr/local/lib/qt4
0:-lc.7 => /lib/libc.so.7
...
465:-lsnoopy.1 => /usr/local/lib/libsnoopy.so.1
...
$
# man ldconfig
...
# tail /var/log/auth.log
...
Jul 26 22:12:38 localhost snoopy[5884]: [uid:0 sid:2957 tty:/dev/pts/2
cwd:/usr/local/lib filename:/sbin/sysctl]: /sbin/sysctl -n hw.machine_arch
Jul 26 22:12:38 localhost snoopy[5885]: [uid:0 sid:2957 tty:/dev/pts/2
cwd:/usr/local/lib filename:/sbin/sysctl]: /sbin/sysctl -n hw.machine
Jul 26 22:12:38 localhost snoopy[5886]: [uid:0 sid:2957 tty:/dev/pts/2
cwd:/usr/local/lib filename:/usr/bin/locale]: /usr/bin/locale
Jul 26 22:12:38 localhost snoopy[5889]: [uid:0 sid:2957 tty: cwd:/usr/local/lib
filename:/usr/bin/head]: head -1
Jul 26 22:12:38 localhost snoopy[5888]: [uid:0 sid:2957 tty:/dev/pts/2
cwd:/usr/local/lib filename:/usr/bin/zcat]: /usr/bin/zcat
/usr/share/man/man8/ldconfig.8.gz
Jul 26 22:12:38 localhost snoopy[5892]: [uid:0 sid:2957 tty: cwd:/usr/local/lib
filename:/usr/bin/groff]: groff -S -P-h -Wall -mtty-char -man -Tascii -P-c
Jul 26 22:12:38 localhost snoopy[5891]: [uid:0 sid:2957 tty: cwd:/usr/local/lib
filename:/usr/bin/tbl]: tbl
Jul 26 22:12:38 localhost snoopy[5890]: [uid:0 sid:2957 tty:/dev/pts/2
cwd:/usr/local/lib filename:/usr/bin/zcat]: /usr/bin/zcat
/usr/share/man/man8/ldconfig.8.gz
Jul 26 22:12:38 localhost snoopy[5893]: [uid:0 sid:2957 tty: cwd:/usr/local/lib
filename:/usr/bin/more]: more
# /etc/rc.d/named status
Cannot 'status' named. Set named_enable to YES in /etc/rc.conf or use
'onestatus' instead of 'status'.
# tail /var/log/auth.log
...
Jul 26 22:16:40 localhost snoopy[5917]: [uid:0 sid:2957 tty:/dev/pts/2
cwd:/usr/local/lib filename:/bin/ps]: /bin/ps -ww -p 5916 -o jid=
Jul 26 22:16:40 localhost snoopy[5919]: [uid:0 sid:2957 tty:/dev/pts/2
cwd:/usr/local/lib filename:/bin/ps]: /bin/ps -ww -o pid= -o jid= -o command=
-ax
#
jb
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?loom.20120726T221857-670>