Zet eens strace voor de sudo.
sudo laat niet met zich sollen......
inaninck@LT9:~$ strace -o trace sudo cat /etc/passwd
sudo: must be setuid root
inaninck@LT9:~$
Als je root bent doet ie het overigens wel alleen moet je wel weten waar je naar zoekt in de trace file.
execve("/usr/bin/sudo", ["sudo", "cat", "/etc/passwd"], [/* 21 vars */]) = 0
brk(0) = 0x9a95000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb77e0000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=102353, ...}) = 0
mmap2(NULL, 102353, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb77c7000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/libpam.so.0", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\34\0\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=46684, ...}) = 0
mmap2(NULL, 49408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x6e0000
En dit is slechts een klein stukje van de 45 KB
