4May
Detecting sudo use without logs [migrated]
Is there any way to positively identify that sudo is being used to execute a command other than to identify the logs? I phrase this in the present tense because I would like to make a command fail if it detects that someone else is using sudo to change users to run a command.
I've been looking at using ps to trace parent process IDs, but it doesn't appear to be reliable with symbolic links.
