Trace Your Own Escalation: The sudo Audit Trail

You are 'student', not root — your prompt ends in $. You hold a scoped sudo grant, and here's the thing most people never see: when you use it, sudo doesn't just make you root, it RECORDS that student became root to run one specific command. That accountability — a real human tied to every privileged action — is the whole reason production uses per-user sudo instead of a shared root password. In this lab you'll generate that trail and then read your own name in it.

The task, in two moves:

1. Run the sanctioned diagnostic as root. Discover your grant with sudo -l, then run the widget diagnostic through sudo. It does its root-only job — and sudo logs the escalation.

2. Preserve your own escalation trail. The sudo log is root-owned (you can't read it as yourself), but your grant also lets you read it. Capture it into the evidence file ~/evidence/sudo-trail.txt (that is /home/student/evidence/sudo-trail.txt, a regular file; create the evidence directory first) for the incident record — and see the line that says student ran the diagnostic as root, timestamped and attributed. That line is what survives you: escalation does not erase identity.

The lesson the audit teams live by: sudo makes you root for a command, but the log remembers who you really are.