It seems command hashing is disabled by default in our
tcsh
environment, and I'm not permitted to get it enabled across the board. Instead I'm looking to enable command hashing within individual scripts, all of which contain while loops, so I'd expect the first iteration to loop through all the paths defined in $PATH
and subsequent iterations to hit the exact path from the internal hash table. The purpose is to reduce the number of failed execve calls captured by the audit service.
First question, is there a command similar to hash
in tcsh to output the internal hash table? Hashstat
doesn't appear to work, it doesn't output anything on the prompt, perhaps because hashing is disabled? When I did get it to print something, it printed only the number and size of hash buckets, not any specific commands.
Main question, I've tried adding rehash
to the beginning of the script, which has helped reduce the number of execve
calls per command from ~5 to ~2 (even on the first iteration). For some reason, it still always tries to run commands from /sbin
first. Any suggestions on what to check to see why after running rehash it still tries to execute a command from an invalid path, or is there an alternative way to enable command hashing from within a script?
Side question, bash on the other hand still manages to hit the correct path even with the hash table disabled. Any idea how it does this without command hashing?
Lastly, strace hasn't captured the failed execve calls captured by audit. I've tried simple strace sleep
, and strace -f -e trace=execve sleep
, both essentially just showing the correct entry, but not the failed ones:
execve("/bin/sleep", ["sleep"], 0x7ffe0d773ff8 /* 32 vars */) = 0
Asked by Maikol
(164 rep)
Mar 17, 2024, 10:38 PM
Last activity: Apr 17, 2025, 09:32 AM
Last activity: Apr 17, 2025, 09:32 AM