Debian bug report logs - #1560
`su' produces incomplete log entries when not in ordinary session

Message received at debian-bugs:

From cus.cam.ac.uk!iwj10 Sat Oct  7 10:37:00 1995
Return-Path: <iwj10@cus.cam.ac.uk>
Received: from pixar.com by mongo.pixar.com with smtp
	(Smail3.1.28.1 #15) id m0t1dBE-000HtBC; Sat, 7 Oct 95 10:37 PDT
Received: from bootes.cus.cam.ac.uk by pixar.com with SMTP id AA02134
  (5.67b/IDA-1.5 for debian-bugs-pipe@mongo.pixar.com); Sat, 7 Oct 1995 10:36:37 -0700
Received: by bootes.cus.cam.ac.uk 
	(Smail-3.1.29.0 #36) id m0t1dB9-000BzQC; Sat, 7 Oct 95 18:36 BST
Received: by chiark
	id <m0t1cS7-0002aLZ@chiark.al.cl.cam.ac.uk>
	(Debian /\oo/\ Smail3.1.29.1 #29.33); Sat, 7 Oct 95 17:50 BST
Message-Id: <m0t1cS7-0002aLZ@chiark.al.cl.cam.ac.uk>
Date: Sat, 7 Oct 95 17:50 BST
From: Ian Jackson <iwj10@cus.cam.ac.uk>
To: Debian bugs submission address <debian-bugs@pixar.com>
Subject: `su' produces incomplete log entries when not in ordinary session

Package: shellutils
Version: 1.12-3

It looks like `su' uses the utmp username field for logging who is
doing the su.  This is broken, because (a) it doesn't work at all if
the process doesn't have a controlling tty and (b) it may give the
wrong answer if utmp is corrupted.

The correct algorithm is to use the utmp username field as a hint: it
should be used if there is a relevant utmp entry and the username in
it has (according to getpwnam) as a uid the ruid of the su process;
otherwise a getpwuid should be done and the name from that used.

Here are some examples of silly log entries:

Sep 15 08:04:53 chiark su: (to news)  on /dev/console
Sep 17 06:42:01 chiark su: (to nobody)  on 

Ian.