3580 2004-02-03 15:01:09 +0300 su command breaks utmp 2005-09-03 00:35:52 +0400 1 1 4 Development Sisyphus su unstable all Linux CLOSED FIXED P2 major --- 1 ipesin placeholder glebfm ldv placeholder vt qa-sisyphus oldest_to_newest 11556 0 ipesin 2004-02-03 15:01:09 +0300 su command breaks utmp log in Alt Linux Master 2.2 + updates and w/who commands show wrong info Example: [ivan@eagle ivan]$ ssh sirius ivan@sirius's password: Last login: Mon Feb 2 13:25:52 2004 from eagle.n-ix.com.ua [ivan@sirius ivan]$ w 13:26:40 up 17:23, 1 user, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ivan pts/0 eagle.n-ix.com.u 1:26pm 0.00s 0.07s 0.01s w [ivan@sirius ivan]$ su - Password: [root@sirius root]# w 13:26:45 up 17:23, 2 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ivan pts/0 eagle.n-ix.com.u 1:26pm 0.00s 0.15s 0.10s /usr/sbin/sshd root pts/0 localhost 1:26pm 0.00s 0.15s 0.02s w [root@sirius root]# Now, open another one connection to this server: [ivan@eagle ivan]$ ssh sirius ivan@sirius's password: Last login: Mon Feb 2 13:26:39 2004 from eagle.n-ix.com.ua [ivan@sirius ivan]$ w 13:27:39 up 17:24, 3 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ivan pts/0 eagle.n-ix.com.u 1:26pm 54.00s 0.13s 0.10s /usr/sbin/sshd ivan pts/1 eagle.n-ix.com.u 1:27pm 0.00s 0.05s 0.01s w root pts/0 localhost 1:26pm 54.00s 0.13s 0.06s -bash [ivan@sirius ivan]$ su - Password: [root@sirius root]# w 13:27:44 up 17:24, 3 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ivan pts/0 eagle.n-ix.com.u 1:26pm 59.00s 0.13s 0.10s /usr/sbin/sshd ivan pts/1 eagle.n-ix.com.u 1:27pm 0.00s 0.09s 0.08s /usr/sbin/sshd root pts/1 localhost 1:27pm 0.00s 0.09s 0.01s w [root@sirius root]# Now you can notice absence of the line root pts/0 localhost 1:26pm 54.00s 0.13s 0.06s -bash Steps to Reproduce: 1. ssh to ALM2.2 as user 2. issue "su" command 3. open another ssh connection to the ALM2.2 server 4. issue "su" command Actual Results: you will see three entries Expected Results: there should be four entries 11561 1 ldv 2004-02-03 23:52:49 +0300 Does logout from second root session (pts/1) unhides first root session (pts/0)? 11565 2 ipesin 2004-02-04 01:36:01 +0300 yes, if I logout second root session, first one apears again: [root@sirius root]# w 00:34:35 up 2 days, 4:31, 3 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ivan pts/0 post-gw.litech.n 12:30am 4:23 0.10s 0.10s /usr/sbin/sshd ivan pts/1 post-gw.litech.n 12:30am 0.00s 0.17s 0.10s /usr/sbin/sshd root pts/1 localhost 12:34am 0.00s 0.17s 0.02s w [root@sirius root]# logout [ivan@sirius ivan]$ w 00:34:51 up 2 days, 4:31, 3 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ivan pts/0 post-gw.litech.n 12:30am 4:39 0.10s 0.10s /usr/sbin/sshd ivan pts/1 post-gw.litech.n 12:30am 0.00s 0.09s 0.01s w root pts/0 localhost 12:30am 4:39 0.10s 0.04s -bash [ivan@sirius ivan]$ 11567 3 ldv 2004-02-04 17:26:38 +0300 I can reproduce this in Sisyphus, thanks. 11574 4 341 ldv 2004-02-04 18:43:03 +0300 Created attachment 341 SimplePAMApps-0.60-owl-login-su-ut_id-undo.patch This patch (partial undo of the SimplePAMApps-0.60-owl-login-su-ut_id.patch) fixes the problem. Looks like ut_id calculation algorithm in our SimplePAMApps differs from openssh and libutempter. I'll contact origin of the patch about that. 11630 5 ipesin 2004-02-06 20:06:07 +0300 It looks it's not a good patch. I've applied it to the SimplePAMApps-0.60-alt15.src.rpm, build it and installed. After that if I issue "su -" command, my name changes to "root" in "w" command, while in *nix systems I've ever used, after su'ing, "w" command shows my real login. Note: when using "su" command without "-" parameter the username has not been changed. Furthermore, after issuing "su -" command breaks lastlog and shows a lot of fake 00:00 records. I've changed a serverity of this bug, because it make really difficult to use ALM2.2 in multiuser environment, when on servers are present a lot of people. 11631 6 ldv 2004-02-06 23:58:39 +0300 When you login with "su -l", your login name changes. When you run "su" without "-l", your login name remains unchanged. Also, I see no fake records in output of the "last" command: joe pts/1 :0 Fri Feb 6 23:51 still logged in root pts/1 localhost Fri Feb 6 23:51 - 23:51 (00:00) joe pts/1 :0 Fri Feb 6 23:50 - 23:51 (00:00) When user joe issued "su -", user root logged on pts/1. That is, joe is not logged in on pts/1 untill root is logged out from pts/1. What's wrong with that? btw, I don't care of *unix systems which mishandle the "su -" case. 11632 7 ldv 2004-02-07 00:00:29 +0300 Responce from origin of the patch: "Actually, the desired behavior is not what Ivan describes. Namely, the intent of that code in su is to temporarily replace the entry, not to add a new one. So the desired result would be to have two entries (for two root sessions), not four." 11634 8 ipesin 2004-02-07 12:52:53 +0300 Ok, I'm really sorry if I had hurt your feelings somehow, but I don't understand why you are so sure, that other *nix-es mishandles "su -". Here is a comment from su.c of rh9: -, -l, --login Make the subshell a login shell. Unset all environment variables except TERM, HOME and SHELL (set as above), and USER and LOGNAME (set unconditionally as above), and set PATH to a default value. Change to USER's home directory. Prepend "-" to the shell's name. If it'll be interesting for you same behavor have had all SCO unixes, saving correction hp-ux, and a lot of other linux distributions. Next, I agree that there should be two entries, not four. Ok, that's fine. Again, if it'll be interesting for you I explain, why I think that current behaivor, when su replaces entry with "root" username is not correct. With such behaivor I can't see which users are currently in system. I see only "root","root","root" ... Moreover, I can't see from where they have loggen in, because "su -" changes FROM field to localhost now. It's really not good from the administration point of view. And way of thinking that the user, who have used "su -" command has logged out is a nonsense! After logout from su shell it don't logout the system, it's going back to the user shell. Furthermore, if you issue "su -" command user process "bash" has an owner of "user". And system reports, that user is not in the system! Further, according to lastlog after logout from su shell user logins to the system, but any logs doesn't have any information about users login. It makes me think, that my system were cracked. I would like to discuss this problem, and no way to hurt your filling, so please don't be so brute in your answers, like in your sentence "btw, I don't care of *unix systems which mishandle the "su -" case. " May be there is a reason, why other "*unix systems which mishandle the "su -" case. " ? 11647 9 mike 2004-02-08 14:24:18 +0300 Still maybe there isn't: there were several su implementations floating around for a long time, and the semantics differed quite noticeably. 11648 10 ipesin 2004-02-08 17:11:02 +0300 Ok. Of course it's ALT prerogative to deside how "su" should work in your distribution. I want to let you know, that is unaccustomed after rh,suse,and unixes because of described reasons. And I'm still sure that it's not usefull to replace utmp record with info "root bla-bla localhost". Nothing informative. Now, to get information about who is in the system I have to use something like ps -ef | grep -- -bash | grep -v grep, and to get info about source of connection I should make a deep magic with lastlog or netstat. And last one, I want to ask you when approx. will be available update at least with provided patch? 11649 11 ldv 2004-02-08 17:27:50 +0300 One more question to clarify the situation: I think that after "su -" logname(1) should print "root". Do you agree with this assumption? About timelines, I'm not decided yet how to fix the issue since it may change behaviour. 11650 12 ipesin 2004-02-08 18:07:47 +0300 Thanks for your quick answer, Dmitry. Now, about your question touching logname(1). I've made a little investigation. I tried following command sequence in rh6.2/7.3/9, sco osr5/unixware7 : 1. login as regular user "ivan" 2. su - 3. logname in all cases (5 times) I got from logname output "ivan". It looks like all of them don't make changes in utmp log after issuing "su -" command. I don't have access on weekend to suse/solaris, but I think there will be same situation. ok, now back to our subject at hand. I think it's good for logname to return "root" in "su -" environment, but it's bad to remove (change utmp entry for) user, who did not logged out. He's in the system, he has issued "su -" command, but he didn't logged out. That's my oppinion. May be it really makes a sense not to change utmp entry but add another for "su -" session? How do you think? 11651 13 ldv 2004-02-08 19:05:56 +0300 Concerning your OS review, I'd like to know *BSD behaviour in this case. Adding second utmp entry with the same ut_line will result to uncertainty in getlogin(3) behaviour, and therefore in logname(1) output: it will return first record with given ut_line. 11653 14 ipesin 2004-02-08 19:24:13 +0300 Ok, *bsd behavior I'll describe tomorrow, since I have no access to that OS during weekend also. 11655 15 342 ldv 2004-02-09 02:02:00 +0300 Created attachment 342 SimplePAMApps-0.60-owl-alt-login-su-ut_id.patch Here is a patch I'm going to use instead of SimplePAMApps-0.60-owl-login-su-ut_id.patch 11661 16 ipesin 2004-02-09 13:21:31 +0300 Could you please describe in few words behaviour of su after applying this patch and after which patch I have to apply it when building? Now about *bsd behaviour of "su -": FreeBSD 4.9-RELEASE-p1 : ssh hellfire -l admin Password: hellfire-admin:~ >$ su - Password: hellfire-root:~ ># logname admin hellfire-root:~ ># --------------- FreeBSD 4.8-RELEASE: ssh thewall Password: kazantip:~ >$ su - Password: root:~ ># logname kazantip I've also checked in suse9 -- same situation, after "su -" logname(1) returns regular user name, not "root". So, how will ALT handle this situation? 11923 17 ldv 2004-02-23 03:56:02 +0300 Fixed in 0.60-alt20 (Sisyphus) and 0.60-owl22 (Owl-current): SimplePAMApps-0.60-owl-alt-login-su-ut_id.patch replaces SimplePAMApps-0.60-owl-login-su-ut_id.patch Thanks for interesting discussion. 11925 18 ipesin 2004-02-23 11:05:36 +0300 thanks for fixing. 11943 19 ipesin 2004-02-24 18:25:02 +0300 Will be fixed rpm available as update for ALM2.2? 11944 20 ldv 2004-02-24 18:43:47 +0300 Do you think it worths errata? 11945 21 ipesin 2004-02-24 19:04:12 +0300 I think worth. If it's interesting for you, I'm running ALM2.2 as db/router/access servers. I'm planning 28 alm2.2 server installations in region (now I've five), and people are working in terminal mode there. It means that all of them do ssh to the servers. Some servers have 50 concurent on-line users load. And it's vitaly to know how much people there are on-line. The same reason was why I wanted ALM behaviour to be the same as other linuxes/unixes in logname(1) handling. But as I understood you decide to left it as it was. And AFAIK ALM2.2 is last available stable server distribution from ALT (am I wrong? compact is beta, isn't it?), so I think fixes of such problems in core utils should be available via apt-get. 11946 22 ldv 2004-02-24 19:17:09 +0300 Ok, I'llprepare update for ALM2.2 11947 23 ipesin 2004-02-24 19:20:31 +0300 thank you 341 2004-02-04 18:43:03 +0300 2004-02-09 02:02:00 +0300 SimplePAMApps-0.60-owl-login-su-ut_id-undo.patch SimplePAMApps-0.60-owl-login-su-ut_id-undo.patch text/plain 1361 ldv ZGlmZiAtdSBTaW1wbGVQQU1BcHBzLTAuNjAvY29tbW9uL2xpYi93dG1wLmMgU2ltcGxlUEFNQXBw cy0wLjYwL2NvbW1vbi9saWIvd3RtcC5jCi0tLSBTaW1wbGVQQU1BcHBzLTAuNjAvY29tbW9uL2xp Yi93dG1wLmMJRnJpIE1hciAgMSAyMzoxNDo1NyAyMDAyCisrKyBTaW1wbGVQQU1BcHBzLTAuNjAv Y29tbW9uL2xpYi93dG1wLmMJRnJpIE1hciAgMSAyMzoxNDo1NyAyMDAyCkBAIC0zLDYgKzMsOSBA QAogICovCiAKICNkZWZpbmUgUkhPU1RfVU5LTk9XTl9OQU1FICAgICAgICAiIiAgICAgLyogcGVy aGFwcyAiW2Zyb20ud2hlcmU/XSIgKi8KKworI2RlZmluZSBERVZJQ0VfRklMRV9QUkVGSVggICAg ICAgICIvZGV2LyIKKwogI2RlZmluZSBXVE1QX0xPQ0tfVElNRU9VVCAgICAgICAgIDMgICAgICAv KiBpbiBzZWNvbmRzICovCiAKICNpbmNsdWRlIDxmY250bC5oPgpAQCAtNDcsNiArNTAsNyBAQAog ICAgIHdoaWxlICgodV90bXBfcCA9IGdldHV0ZW50KCkpICE9IE5VTEwpCiAJaWYgKCh1X3RtcF9w LT51dF90eXBlID09IElOSVRfUFJPQ0VTUyB8fAogCSAgICAgdV90bXBfcC0+dXRfdHlwZSA9PSBM T0dJTl9QUk9DRVNTIHx8CisJICAgICB1X3RtcF9wLT51dF90eXBlID09IERFQURfUFJPQ0VTUyB8 fAogCSAgICAgdV90bXBfcC0+dXRfdHlwZSA9PSBVU0VSX1BST0NFU1MpICYmCiAJICAgICFzdHJu Y21wKHVfdG1wX3AtPnV0X2xpbmUsIHV0X2xpbmUsIFVUX0xJTkVTSVpFKSkgewogCSAgICBpZiAo IXN0cm5jbXAodV90bXBfcC0+dXRfaWQsIHV0X2lkLCBVVF9JRFNJWkUpKQpAQCAtODEsMTggKzg1 LDEzIEBACiAgICAgaWYgKCAqdGVybWluYWwgPT0gJy8nICkgeyAgICAgLyogbm93IGRlYWwgd2l0 aCBmaWxlbmFtZXMgKi8KIAlpbnQgbzEsIG8yOwogCi0JbzEgPSBzdHJuY21wKCIvZGV2LyIsIHRl cm1pbmFsLCA1KSA/IDAgOiA1OworCW8xID0gc3RybmNtcChERVZJQ0VfRklMRV9QUkVGSVgsIHRl cm1pbmFsLCA1KSA/IDAgOiA1OwogCWlmICghc3RybmNtcCgiL2Rldi90dHkiLCB0ZXJtaW5hbCwg OCkpIHsKIAkgICAgbzIgPSA4OwogCX0gZWxzZSB7Ci0JICAgIGlmICghc3RybmNtcCgiL2Rldi9w dHMvIiwgdGVybWluYWwsIDkpKQotCQlvMSA9IDg7IC8qIGluY2x1ZGUgdGhlIHNsYXNoICovCi0J ICAgIG8yID0gc3RybGVuKHRlcm1pbmFsICsgbzEpIC0gVVRfSURTSVpFOworCSAgICBvMiA9IHN0 cmxlbih0ZXJtaW5hbCkgLSBzaXplb2YoVVRfSURTSVpFKTsKIAkgICAgaWYgKG8yIDwgMCkKIAkJ bzIgPSAwOwotCSAgICBvMiArPSBvMTsKLQkgICAgaWYgKG8xID4gNSkKLQkJbzEgPSA1OwogCX0K IAogCXN0cm5jcHkodXRfbGluZSwgdGVybWluYWwgKyBvMSwgVVRfTElORVNJWkUpOwo= 342 2004-02-09 02:02:00 +0300 2004-02-09 02:02:00 +0300 SimplePAMApps-0.60-owl-alt-login-su-ut_id.patch SimplePAMApps-0.60-owl-alt-login-su-ut_id.patch text/plain 2339 ldv ZGlmZiAtdXByay5vcmlnIFNpbXBsZVBBTUFwcHMtMC42MC5vcmlnL2NvbW1vbi9saWIvd3RtcC5j IFNpbXBsZVBBTUFwcHMtMC42MC9jb21tb24vbGliL3d0bXAuYwotLS0gU2ltcGxlUEFNQXBwcy0w LjYwLm9yaWcvY29tbW9uL2xpYi93dG1wLmMJMTk5OS0wMS0yNyAxOToyNzoxNiArMDMwMAorKysg U2ltcGxlUEFNQXBwcy0wLjYwL2NvbW1vbi9saWIvd3RtcC5jCTIwMDQtMDItMDggMjA6MDE6NTYg KzAzMDAKQEAgLTMsOSArMyw2IEBACiAgKi8KIAogI2RlZmluZSBSSE9TVF9VTktOT1dOX05BTUUg ICAgICAgICIiICAgICAvKiBwZXJoYXBzICJbZnJvbS53aGVyZT9dIiAqLwotCi0jZGVmaW5lIERF VklDRV9GSUxFX1BSRUZJWCAgICAgICAgIi9kZXYvIgotCiAjZGVmaW5lIFdUTVBfTE9DS19USU1F T1VUICAgICAgICAgMyAgICAgIC8qIGluIHNlY29uZHMgKi8KIAogI2luY2x1ZGUgPGZjbnRsLmg+ CkBAIC00MSwxOSArMzgsMzEgQEAKICAqLwogCiBzdGF0aWMKLWNvbnN0IHN0cnVjdCB1dG1wICpm aW5kX3V0bXBfZW50cnkoY29uc3QgY2hhciAqdXRfbGluZQotICAgICAgICAsIGNvbnN0IGNoYXIg KnV0X2lkKQorY29uc3Qgc3RydWN0IHV0bXAgKmZpbmRfdXRtcF9lbnRyeShjb25zdCBjaGFyICp1 dF9saW5lLCBjaGFyICp1dF9pZCkKIHsKLSAgICBzdHJ1Y3QgdXRtcCAqdV90bXBfcDsKKyAgICBz dHJ1Y3QgdXRtcCAqdV90bXBfcCwgKmJlc3Q7CiAKKyAgICBzZXR1dGVudCgpOworICAgIGJlc3Qg PSBOVUxMOwogICAgIHdoaWxlICgodV90bXBfcCA9IGdldHV0ZW50KCkpICE9IE5VTEwpCiAJaWYg KCh1X3RtcF9wLT51dF90eXBlID09IElOSVRfUFJPQ0VTUyB8fAotICAgICAgICAgICAgIHVfdG1w X3AtPnV0X3R5cGUgPT0gTE9HSU5fUFJPQ0VTUyB8fAotICAgICAgICAgICAgIHVfdG1wX3AtPnV0 X3R5cGUgPT0gVVNFUl9QUk9DRVNTIHx8Ci0gICAgICAgICAgICAgdV90bXBfcC0+dXRfdHlwZSA9 PSBERUFEX1BST0NFU1MpICYmCi0gICAgICAgICAgICAhc3RybmNtcCh1X3RtcF9wLT51dF9pZCwg dXRfaWQsIFVUX0lEU0laRSkgJiYKLSAgICAgICAgICAgICFzdHJuY21wKHVfdG1wX3AtPnV0X2xp bmUsIHV0X2xpbmUsIFVUX0xJTkVTSVpFKSkKLSAgICAgICAgICAgICAgICBicmVhazsKKwkgICAg IHVfdG1wX3AtPnV0X3R5cGUgPT0gTE9HSU5fUFJPQ0VTUyB8fAorCSAgICAgdV90bXBfcC0+dXRf dHlwZSA9PSBVU0VSX1BST0NFU1MpICYmCisJICAgICFzdHJuY21wKHVfdG1wX3AtPnV0X2xpbmUs IHV0X2xpbmUsIFVUX0xJTkVTSVpFKSkgeworCSAgICBpZiAoIXN0cm5jbXAodV90bXBfcC0+dXRf aWQsIHV0X2lkLCBVVF9JRFNJWkUpKQorCQlicmVhazsKKwkgICAgYmVzdCA9IHVfdG1wX3A7CisJ fQorCisgICAgaWYgKCF1X3RtcF9wICYmIGJlc3QpIHsKKwl1X3RtcF9wID0gYmVzdDsKKwlzdHJu Y3B5KHV0X2lkLCB1X3RtcF9wLT51dF9pZCwgVVRfSURTSVpFKTsKKyAgICB9CisKKyNpZiAwCisg ICAgZnByaW50ZihzdGRlcnIsICJmaW5kX3V0bXBfZW50cnk6ICclLjMycycgJyUuNHMnOiAlcFxu IiwKKwl1dF9saW5lLCB1dF9pZCwgdV90bXBfcCk7CisjZW5kaWYKIAogICAgIHJldHVybiB1X3Rt cF9wOwogfQpAQCAtNzIsMTEgKzgxLDExIEBAIHZvaWQgc2V0X3Rlcm1pbmFsX25hbWUoY29uc3Qg Y2hhciAqdGVybWkKICAgICBpZiAoICp0ZXJtaW5hbCA9PSAnLycgKSB7ICAgICAvKiBub3cgZGVh bCB3aXRoIGZpbGVuYW1lcyAqLwogCWludCBvMSwgbzI7CiAKLQlvMSA9IHN0cm5jbXAoREVWSUNF X0ZJTEVfUFJFRklYLCB0ZXJtaW5hbCwgNSkgPyAwIDogNTsKKwlvMSA9IHN0cm5jbXAoIi9kZXYv IiwgdGVybWluYWwsIDUpID8gMCA6IDU7CiAJaWYgKCFzdHJuY21wKCIvZGV2L3R0eSIsIHRlcm1p bmFsLCA4KSkgewogCSAgICBvMiA9IDg7CiAJfSBlbHNlIHsKLQkgICAgbzIgPSBzdHJsZW4odGVy bWluYWwpIC0gc2l6ZW9mKFVUX0lEU0laRSk7CisJICAgIG8yID0gKGludClzdHJsZW4odGVybWlu YWwpIC0gVVRfSURTSVpFOwogCSAgICBpZiAobzIgPCAwKQogCQlvMiA9IDA7CiAJfQpAQCAtMjAz LDcgKzIxMiw2IEBAIGludCB1dG1wX2RvX29wZW5fc2Vzc2lvbihjb25zdCBjaGFyICp1c2UKICAg ICBzZXRfdGVybWluYWxfbmFtZSh0ZXJtaW5hbCwgdXRfbGluZSwgdXRfaWQpOwogCiAgICAgdXRt cG5hbWUoX1BBVEhfVVRNUCk7Ci0gICAgc2V0dXRlbnQoKTsgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgLyogcmV3aW5kIGZpbGUgKi8KICAgICB1X3RtcF9wID0gZmlu ZF91dG1wX2VudHJ5KHV0X2xpbmUsIHV0X2lkKTsKIAogICAgIC8qIHJlc2V0IG5ldyBlbnRyeSAq Lwo=