2

This problem is in an up-to-date 12.04, and seems to have started recently.

I have my .bash_history file set to read only. Lately I've noticed that despite this the file is being modified ! Here's the scenario. In a new terminal, here is the tail of the file:

$ tail -5 .bash_history 
mkdir -p ttt ; gs -dNOPAUSE -sDEVICE=png16m -r180 -sOutputFile=ttt/p%03d.png *.pdf
rsync -av /home/u1204 /media/SEAGATE/u1204 
gnote.late.reminders|GREP_COLOR='1;32' egrep -i "is overdue"
pvr_iplayer -x -HD /home/u1204/Documents/pvr/tv-hd ; pvr_iplayer -x -STD /home/u1204/Documents/pvr/tv-std
exit

open a shell with raised privileges

 $ sudo bash [sudo] 
 password for u1204: 

 # ls -l ~/.bash_history
 -r-------- 1 u1204 u1204 1266 Feb 23 19:52 /home/u1204/.bash_history

so .bash_history is still definitely read-only. Do something, then exit the escalated shell:

# echo "written to history file"
written to history file

# exit
exit

And Voilà, the history file has been modified !

$ ls -l ~/.bash_history
-r-------- 1 u1204 u1204 1324 Feb 23 20:10 /home/u1204/.bash_history

Open another terminal to confirm:

$ tail -5 .bash_history 
pvr_iplayer -x -HD /home/u1204/Documents/pvr/tv-hd ; pvr_iplayer -x -STD /home/u1204/Documents/pvr/tv-std
exit
ls -l ~/.bash_history
echo "written to history file"
exit

I'm pretty sure that it didn't used to do this (in 10.04 at least).

Anyway, this can't be correct behaviour, can it?

4

Root has universal read/write to everything. Period.

Proponents of windows like to claim its authentication system is stronger because it doesn't have a "god" account and even local administrators can be explicitly denied.

You cannot deny root any access to any thing on the local system.

After some comments, it got me thinking you might be looking for a way to not write to bash history at all. You could do that like this: http://www.commandlinefu.com/commands/view/7041/dont-save-commands-in-bash-history-only-for-current-session

Putting unset HISTFILE in your bashrc for those that don't want to follow the link.

  • 1
    Root has universal read/write to everything. Period. I Agree, alas if you use sudo su - the above described situation doesn't happen. I think this is the difference he asked about. Correct me if I'm wrong of course. – catalesia Feb 23 '13 at 21:42
  • I read it differently. I saw "How do I deny root access to my bash history" and answered with - you can't. – RobotHumans Feb 23 '13 at 21:50
  • Thanks for the replies. I must be misrembering or am doing something differently, because I don't ever recall t his happening before. – Thorsen Feb 23 '13 at 22:08
  • @AbrahamVanHelpsing: Could you (without any special effort) point me to an explanation to why what I describe in my Answer happens? It's quite confusing that what Thorsen describes does happen when you sudo, but when you sudo su -, it doesn't. Much obliged. – catalesia Feb 23 '13 at 22:18
  • 2
    @catalesia - Your answer is poor for multiple reasons. One of which is: sudo su - makes sure that environment variables are not kept. Use both invocations of the command sudo /bin/bash and sudo su -i or google for the difference. In each, cd ~ and see what happens. For people that need sudo for non-trivial tasks, enviroment variables are necessary. So your answer while it may answer a corner case, is incorrect. Congratulations on convincing me to downvote it now that you kept pushing at it. – RobotHumans Feb 24 '13 at 0:10
4

Yes, you can ultimatively deny access.

chattr +i
  • Fair point. And it gets an upvote from me – RobotHumans Feb 23 '13 at 22:18
  • (i would have commented it into the thread above, yet i was obviously not able to make the UI do it. ;) – emmcee Feb 23 '13 at 22:21
0

@Thor

I'm pretty sure that it didn't used to do this (in 10.04 at least).

It actually does.

What I think happens is if you use sudo, you still get to keep your identity but with lifted privileges, if you used sudo su - on the other hand, you would have become the "real root". hence the difference.

  • okay, I must be misrembering – Thorsen Feb 23 '13 at 22:02
0

RO is nothing a program cannot override, as long as you're root or owner of the file. So the correct way is not to set the file to r--, but to execute

unset HISTFILE

For "sudo -s" this should work (environment is copied, exactly the reason why your user's .bash_history is used), for "sudo -i" (like "su -") you're using /root/.bash_history anyway. If you do not want to do this, you need to unset HISTFILE in your root's .bashrc/.bash_profile.

btw: as already mentioned the correct way to get a root-shell is sudo -s / sudo -i. "sudo su" or "sudo bash" works, but its a rather unclean way to do so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.