'w' and 'who'

Discuss usability issues, general maintenance, and general support issues for a grsecurity-enabled system.

'w' and 'who'

Postby miha » Sun Dec 08, 2002 8:19 pm

Hello,

Just intersting -

When I am running 'w' in shell I this this:

[miha@serv miha]$ w
7:20pm up 8:31, 2 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
[miha@serv miha]$

as you can see it doesn't show actual users (as it should be I believe)

.. but when I run 'who' I can see who, host, which pty, when:

[miha@serv miha]$ who
root pts/0 Dec 8 10:51 (localhost)
miha pts/1 Dec 8 18:10 (home)
[miha@serv miha]$

Is it should be so? Can it be changed in the future version so that both 'w' and 'who' don't show info? I'm running 2.4.19

Regards,
Miha.
miha
 
Posts: 28
Joined: Sat Nov 30, 2002 9:09 am

Postby spender » Sun Dec 08, 2002 8:51 pm

w uses input from /proc, while who uses input from /var/run/utmp and /var/log/wtmp. The /proc restrictions is modifying the w output. To restrict who (and last) output, you'll have to make /var/run/utmp and /var/log/wtmp non-world-readable, and allow some utmp group to access them, and then make who and last sgid utmp. You can then modify who and last so that it returns the kind of output you want.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Postby miha » Sun Dec 08, 2002 9:52 pm

thanks for explaining!

Miha.
miha
 
Posts: 28
Joined: Sat Nov 30, 2002 9:09 am

Postby puppetm » Fri Dec 13, 2002 11:06 am

spender wrote:w uses input from /proc, while who uses input from /var/run/utmp and /var/log/wtmp. The /proc restrictions is modifying the w output. To restrict who (and last) output, you'll have to make /var/run/utmp and /var/log/wtmp non-world-readable, and allow some utmp group to access them, and then make who and last sgid utmp. You can then modify who and last so that it returns the kind of output you want.

-Brad


Could you explain this a little more? the utmp group who should be in this group?
puppetm
 
Posts: 11
Joined: Thu Dec 12, 2002 2:59 pm

Postby spender » Fri Dec 13, 2002 11:10 am

noone should be in the utmp group. who and last and such should be sgid utmp. /var/log/wmtp and /var/run/utmp should be readable by only root and group utmp.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm


Return to grsecurity support