[sudo-users] excluding commands from log_output

[Todd C. Miller]

On Sun, 13 Nov 2016 01:16:16 +0200, Divan Santana wrote:

> I've enabled log_output but would like to prevent certain commands from
> being logged, like top for example.

You can create a Cmnd_Alias containing the commands for which you
want to disable I/O logging.  For example:

Cmnd_Alias NOIOLOG = /ust/bin/top, /usr/bin/ps
Defaults!NOIOLOG !log_output

> Lastly, would the above work in this scenario:
> bob at host:$ sudo su - root
> root at host:# top
> 
> Ie, when one invokes the top command sometime after sudo, during the
> sudo "session".

No, that won't work since sudo would log the entire "su" session.

Note that top is not entirely benign, however, since you can use
it to kill or renice arbitrary processes.

 - todd