How to trace process that has already terminated? And even trace back its parent process?

George Y

7/19/24, 4:09 AM

I am able to jail specific commands execution by a proxy script to a user whose sudo privilege is only this script sodo check here for how to. Also the sodo script logs whatever critical commands they ordered:

sodo:

#!/bin/bash
# pass command by non-sudoers who can only run some command via this script
case $1 in
  firewall-cmd|ip|systemctl)
    #echo $*
    eval $*
    ret=$?
    ;;
  *)
     echo 'your request is not allowed yet, please contact the root user'
     exit 1
     ;;
esac

if [ $ret -eq 0 ];then
  echo `date +"%Y-%m-%d %X"`": executed order from" `pwd` "by pid" $$ "to" $* >> /root/sodo.log
fi

You might argue the script above does not log the exact user by $USER who runs firewall-cmd|ip|systemctl. Correct, it is because they run sodo as the root user, and $USER=root so that those 3 would allow them to run given that their sudo privilege does not include the 3.

But here is the loop hole - they can run sodo inside a python script inside some public path like var and it is impossible to pin down who runs it (who stopped the service maliciously). Now that I have recorded $$ the pid to run sodo, is it possible to trace back the parent pid's back to the login process to pin down who was the actual commander?

I figure out a way to trace back its parent user while this script is being processed - since its parent process is not dead yet and $$ can trace everything about it by ps and basic search, it is possible to log the user of its parent process, who was the real commander on this script.

0 + 4

security

linux

user-management

user-permissions

AlexD

7/19/24, 5:36 AM

You seem to be reimplementing `sudo` capabilities in the script. `sudo` can restrict allowed commands on its own and also does log commands in `auth.log`. Also you want to look into `auditd`.

A.B

7/19/24, 7:35 PM

What could go wrong by passing `ip ; poweroff` as parameters to `eval $*`?

George Y

7/24/24, 7:42 AM

@A.B it could go wrong, so I log the call in the end, and `poweroff` is not included in the first condition. You could elaborate the conditions by adding more control flow lines.

A.B

7/24/24, 3:38 PM

The answer: eval will evaluate the command poweroff, while you only checked for the command ip. Never use the eval command provided with untrusted data

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to trace process that has already terminated? And even trace back its parent process?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.