I packaged rootsh and added it to the grml-chroot.
Rootsh is a wrapper for shells which logs all echoed keystrokes and
terminal output to a file and/or to syslog. It's main purpose is the
auditing of users who need a shell with root privileges. They start
rootsh through the sudo mechanism.