From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/609 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: utmpx support Date: Sun, 4 Mar 2012 13:18:08 -0500 Message-ID: <20120304181808.GU184@brightrain.aerifal.cx> References: Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: dough.gmane.org 1330885127 29447 80.91.229.3 (4 Mar 2012 18:18:47 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Sun, 4 Mar 2012 18:18:47 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-610-gllmg-musl=m.gmane.org@lists.openwall.com Sun Mar 04 19:18:47 2012 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1S4G18-00038M-J1 for gllmg-musl@plane.gmane.org; Sun, 04 Mar 2012 19:18:46 +0100 Original-Received: (qmail 9946 invoked by uid 550); 4 Mar 2012 18:18:46 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 9937 invoked from network); 4 Mar 2012 18:18:46 -0000 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:609 Archived-At: On Sun, Mar 04, 2012 at 06:41:25PM +0100, finkler wrote: > Hi there, > > I was wondering whether it is intentional or just due to more > pressing tasks that utmpx is a stub? It's intentional, but if you have a real need for utmp support, I'd be willing to hear about it. My own view is that utmp is a major source of security risks due both to the need for suid/sgid binaries to access it and the inherent information leak of publicly publishing users' login status, and that it has few if any legitimate purposes. It comes from a very different era/culture, reminiscent of the days when putting a password on your account was seen as offensive. :-) > If it is because of the latter I would gladly be of help, after all > this seems kind of trivial, or am I missing something? Perhaps a better approach would be making a separate small static libutmp.a that could be linked by people wanting real utmp support as opposed to the stubs. Rich