Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] Additional capture files besides stdout/stderr #58

Open
eatnumber1 opened this issue Jan 22, 2025 · 0 comments
Open

[Feature] Additional capture files besides stdout/stderr #58

eatnumber1 opened this issue Jan 22, 2025 · 0 comments

Comments

@eatnumber1
Copy link
Contributor

eatnumber1 commented Jan 22, 2025

Consider the following command taken directly from the find.1 man page

Traversing the filesystem just once - for 2 different actions

  • Traverse the filesystem just once, listing set-user-ID files and directories into /root/suid.txt and large files into /root/big.txt.
$ find / \
    \( -perm -4000 -fprintf /root/suid.txt '%#m %u %p\n' \) , \
    \( -size +100M -fprintf /root/big.txt '%-10s %p\n' \)

This example uses the line-continuation character '\' on the first two lines to instruct the shell to continue reading the command on the next line.

Can this command be bkt'ed? I'm pretty sure not. The issue is that it affects files other than stdout/stderr, so future replays by bkt would not write to the files. Even if one of the files was /dev/stdout instead of /root/suid.txt, the other file would still not be affected.

If bkt gets a new feature, the ability to set files other than stdout/stderr as data to be captured + replayed, this could be made to work. Hypothetically, it could be e.g. bkt --output-file=/root/suid.txt --output-file=/root/big.txt --ttl=1h -- find ....

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant