[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20090514183349.GA7149@suse.de>
Date: Thu, 14 May 2009 20:33:49 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: utmp reliability?
Hi,
While debugging a problem for a customer of us I found that UTMP entries
are not generated reliably and utmp entry creation starts to fail on
higher loads/more users or more utmp activity.
Reason is that glibc locks the UTMP file on write/read with a 1 second
timeout, and if that 1 second timeout triggers no entry is written.
Sadly without any indication of failure if you use login(3) or pututline(3). :(
I am wondering if handling UTMP should be more reliable or if at least error
reporting should happen.
Making it reliable will make it possible to DoS any kind of logins / terminal
opens of course, but make it easier on app writers using utmp.
(Yes, I know the really reliable way is Audit, but this is not user readable.)
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
