Darren J Moffat wrote: > With my ARC hat on I don't think we shouldn't be vandalising upstream > man pages like this in my opinion. This case is to ship sudo as is > and the case explictly says so. We don't list all the other things > that don't do auditing yet authenticate users, for example webmin > authenticates users but doesn't audit, Apache has modules to > authenticate unix users and doesn't audit. We didn't change those > other components documentation to say they don't audit so I don't > think we should ask this project to to that to the sudo ones.
I'm not sure I agree with this. We understand that we have little control about the content of the actual binaries. The only thing we can control is the documentation (more exactly, supplement the documentation). We should *never* make subjective statements in the documentation, but factual "Danger Will Robertson" NOTES seem quite appropriate. (Note, there is a minor discussion about this on OpenSolaris.... A community member would like to add such NOTES, but doesn't want to because it means "unzipping - editing - zipping" the upstream "tar/zip file.) Also, we know that many things don't audit. We know that su does audit. The expectation would be that "When in Rome, act like a Roman" (where have I heard that before?). Because su does auditing, the expectation would be that sudo would do auditing. Since it doesn't (for reasonable reasons - future directions), we should address that expectation. - jek3
