deceptive mail and /bin/login

[Karl Kleinpaste]

----------
> How about having login check that its parent is init (i.e. parent's PID==1)?
> Then, you can still do "login newuser" from the shell, as designed, and
> everything works properly, but people who try to do the bogus
> "(login newuser)" get thrown back into their original shell without the
> wtmp ever getting changed.
----------
Correct me if I'm wrong, but I  don't think  that's going to work due to the
existence  and  use of ptys in 4.2BSD. I believe that there  are  situations
where bona fide and  legitimate  logins are  not  owned by init.  Um, rlogin
comes  to mind. We only converted to 4.2 a few weeks ago and I  haven't  had
the time to study that code  yet,  but it  seems that you're approaching the
problem  from the wrong end; many scenarios can be created  where  something
acting as a real login  session  is  not a  child  of  init. Sounds like the
problem  is that there is a need for shells to keep /etc/utmp  updated  when
they log{in,out}.

Are the shells spawned by the  window manager on Sun workstations considered
login  shells?  If  so, there's another case where the  login  is  owned  by
neither init nor rlogind.
-- 
Karl Kleinpaste @ Bell Labs, Columbus   614/860-5107    {cbosgd,ihnp4}!cbrma!kk
                @ Ohio State University 614/891-5058      cbosgd!osu-eddie!karl
                                                     karl.Ohio-State at Rand-Relay