1

I have an environment variable whose value didn't match the one set by /etc/environment, even after reboot. I eventually found the auto-executed .sh script changing it, but that incident got me interested.

Is there a way to monitor (or log, or whatever available) all changes made to environment ?

Preferably with timestamp, variable accessed, value set, user responsible, and path to bash script used when available. Not all of them mandatory, but the more the better.

On a side note I'm currently using Ubuntu14.04, but answers concerning different OS's are very welcome.

Cheers

1 Answer 1

1

That'd be difficult.

Environment variables aren't monitorable objects – they exist in the programs' own memory, and they're just a bunch of text that processes pass down to their children. Thus it's next to impossible to audit their access at a system level. At best, you could use strace to see what env is passed to new processes during process creation (specifically the execve syscall) – that's assuming you can manage to attach it early enough.

(However, strace won't show you what happens inside a process. So if you try tracing bash, you'll only see what it starts with, and what it ends up passing forward, but you won't see what individual /etc/profile.d scripts do.)

This also means bash scripts aren't the only thing that can affect the variables. Many of them are in fact set by PAM modules, or by the login program itself. In particular, /etc/environment is usually read by the "pam_env" module.

1
  • Thanks. I knew bash scripts were just one of many ways to affect those, all the more reason why I was hoping to find some kind of history of changes.
    – bezout
    Feb 2, 2016 at 16:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .