[9022] in bugtraq
getlogin() is not secure
daemon@ATHENA.MIT.EDU (Ian! D. Allen [NCFreeNet])
Sun Jan 10 14:33:56 1999
Date: Sat, 9 Jan 1999 15:12:00 -0500
Reply-To: "Ian! D. Allen [NCFreeNet]" <idallen@FREENET.CARLETON.CA>
From: "Ian! D. Allen [NCFreeNet]" <idallen@FREENET.CARLETON.CA>
X-To: Thamer Al-Herbish <shadows@WHITEFANG.COM>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: Thamer Al-Herbish <shadows@WHITEFANG.COM> "Re: setuid vs. setgid
(was Re: Anonymous Qmail Denial of Service)" (Jan 8, 17:36)
>From: Thamer Al-Herbish <shadows@WHITEFANG.COM> Jan 8, 17:36
>To be extra pedantic use getlogin() to double check. getlogin cannot
>lie unless you are root and did a setlogin().
>From "man getlogin" on my SuSE 5.2 Linux system:
"getlogin returns a pointer to a string containing the name of the user
logged in on the controlling terminal of the process, or a null
pointer if this information cannot be determined."
I haven't tried this in years, but I used to be able to send mail from
anyone who was logged in by writing a little script that disconnected the
controlling terminal of my process and then pointed at the writable
terminal of someone currently online (thus adopting that terminal as the
controlling terminal of my process). Then getlogin() would think I was them.
Terminals are less writable these days, of course, but I still won't
use getlogin() for anything.
I couldn't find "setlogin" under Linux or Solaris 2.6.
--
-IAN! Ian! D. Allen Ottawa, Ontario, Canada idallen@freenet.carleton.ca
Home Page on the Ottawa FreeNet: http://www.ncf.carleton.ca/~aa610/
College professor at: http://www.algonquinc.on.ca/~alleni/
Board Member, TeleCommunities CANADA http://www.tc.ca/
