grsecurity forums

Hello,

Just intersting -

When I am running 'w' in shell I this this:

[miha@serv miha]$ w
7:20pm up 8:31, 2 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
[miha@serv miha]$

as you can see it doesn't show actual users (as it should be I believe)

.. but when I run 'who' I can see who, host, which pty, when:

[miha@serv miha]$ who
root pts/0 Dec 8 10:51 (localhost)
miha pts/1 Dec 8 18:10 (home)
[miha@serv miha]$

Is it should be so? Can it be changed in the future version so that both 'w' and 'who' don't show info? I'm running 2.4.19

Regards,
Miha.

w uses input from /proc, while who uses input from /var/run/utmp and /var/log/wtmp. The /proc restrictions is modifying the w output. To restrict who (and last) output, you'll have to make /var/run/utmp and /var/log/wtmp non-world-readable, and allow some utmp group to access them, and then make who and last sgid utmp. You can then modify who and last so that it returns the kind of output you want.

-Brad

thanks for explaining!

Miha.

spender wrote:w uses input from /proc, while who uses input from /var/run/utmp and /var/log/wtmp. The /proc restrictions is modifying the w output. To restrict who (and last) output, you'll have to make /var/run/utmp and /var/log/wtmp non-world-readable, and allow some utmp group to access them, and then make who and last sgid utmp. You can then modify who and last so that it returns the kind of output you want.

-Brad

Could you explain this a little more? the utmp group who should be in this group?

noone should be in the utmp group. who and last and such should be sgid utmp. /var/log/wmtp and /var/run/utmp should be readable by only root and group utmp.

-Brad