Date: Thu, 14 May 2009 20:33:49 +0200 From: Marcus Meissner <meissner@...e.de> To: OSS Security List <oss-security@...ts.openwall.com> Subject: utmp reliability? Hi, While debugging a problem for a customer of us I found that UTMP entries are not generated reliably and utmp entry creation starts to fail on higher loads/more users or more utmp activity. Reason is that glibc locks the UTMP file on write/read with a 1 second timeout, and if that 1 second timeout triggers no entry is written. Sadly without any indication of failure if you use login(3) or pututline(3). :( I am wondering if handling UTMP should be more reliable or if at least error reporting should happen. Making it reliable will make it possible to DoS any kind of logins / terminal opens of course, but make it easier on app writers using utmp. (Yes, I know the really reliable way is Audit, but this is not user readable.) Ciao, Marcus
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.