NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/comp/sys/sun/admin/8627

Internet Message Format | 1992-11-24 | 2.0 KB

Xref: sparky comp.sys.sun.admin:8627 comp.unix.admin:6355 comp.unix.programmer:5414 comp.unix.wizards:4878
Newsgroups: comp.sys.sun.admin,comp.unix.admin,comp.unix.programmer,comp.unix.wizards
Path: sparky!uunet!elroy.jpl.nasa.gov!usc!rpi!batcomputer!theory.TC.Cornell.EDU!mdw
From: [e-mail] (Matt Welsh)
Subject: Re: revisited, determining if anyone else is logged on
Message-ID: <[e-mail]>
Sender: [e-mail]
Nntp-Posting-Host: theory.tc.cornell.edu
Organization: Cornell Theory Center
References: <[e-mail]>
Date: Tue, 24 Nov 1992 04:11:10 GMT
Lines: 28

In article <[e-mail]> [e-mail] (Steven Myrtle) writes:
[About finding out users that are logged in without use of "who" et al.]
>Some people have gotten
>closer to what I'm asking for.  They suggested I use system(), fork(),
>execl(), etc., to execute a w, who, finger, etc.  But I don't at all
>consider doing that from within a setuid program to be a good practice,
>and I won't do it.

Using execv(), with the complete pathname to the program to exec should be
quite safe. Of course it depends on having "who" or "w", etc. available.
System() has problems because it goes through sh, and you have to deal with
a few rudimentary security issues. I don't think that this is a problem if
you fork() and execv() the new image, even if the program is setuid (because
you're not going through a shell, and the exec'd program should be just as
secure as your own setuid program in the child process). That is, of course,
assuming that the program you're execv'ing doesn't have its own security
problems (which "who" and friends shouldn't).

I don't generally like having programs depend on other system programs,
but for 90% of your applications this shouldn't be a problem at all.

But if you want to roll your own, be my guest. :)

mdw

--
Matt Welsh    [e-mail]        [phone]
  "We're going away now. I fed the cat."