getlogin() is not secure

From: Ian! D. Allen [NCFreeNet] (idallenat_private)
Date: Sat Jan 09 1999 - 12:12:00 PST

  • Next message: Madere, Russel: "Re: Bigfoot/Bellsouth Webmail bug"

    >From: Thamer Al-Herbish <shadowsat_private>  Jan  8, 17:36
    >To be extra pedantic use getlogin() to double check. getlogin cannot
    >lie unless you are root and did a setlogin().
    
    >From "man getlogin" on my SuSE 5.2 Linux system:
    
       "getlogin returns a pointer to a string containing the name of the user
        logged in on the controlling terminal  of  the process,  or  a null
        pointer if this information cannot be determined."
    
    I haven't tried this in years, but I used to be able to send mail from
    anyone who was logged in by writing a little script that disconnected the
    controlling terminal of my process and then pointed at the writable
    terminal of someone currently online (thus adopting that terminal as the
    controlling terminal of my process).  Then getlogin() would think I was them.
    
    Terminals are less writable these days, of course, but I still won't
    use getlogin() for anything.
    
    I couldn't find "setlogin" under Linux or Solaris 2.6.
    
    --
    -IAN!  Ian! D. Allen   Ottawa, Ontario, Canada   idallenat_private
           Home Page on the Ottawa FreeNet: http://www.ncf.carleton.ca/~aa610/
           College professor at: http://www.algonquinc.on.ca/~alleni/
           Board Member, TeleCommunities CANADA  http://www.tc.ca/
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:28:22 PDT