How to check whether a linux shell command is readonly?

Question

I have a shell command flow from many users, and I want to filter readonly commands. Now, my solution is to check each command with a readonly command list (eg, cd , ll , ls , cat , ldd , top and so on).

There are 2 drawbacks in my solution:

1. the command list may not contain all readonly commands, or there are some non-readonly commands in the list,
2. it may cost too much, each flow item will be compared with each one in the list.

So, is there any better solution for this problem?

Answer 1

Sounds like you may be looking for auditd , available for Linux (not sure about other OS's). This facility will allow you to put alerts on whatever files you want so that writes to them are logged. You can also audit system calls.