>> For the r* utilities, what I have normally done is something like

>> 	user = getenv("USER")
>> 	if user!=0 and (pw=getpwnam(user))!=0
>> 		if getuid()==0 or getuid()==pw->pw_uid
>> 			use pw

> But this allows you to "su" to any of the other users with the same
> uid by just altering your USER environment variable ...

Not really; it lets you pseudo-su only for purposes of using the
affected r* program(s).  In this respect it's certainly no worse than
the previous behavior, which willy-nilly forced you to appear to be
whichever of those users was returned by getpwuid()...unless you had
something that depended on the latter behavior, in which case, well, I
guess in that case you don't want to make these changes. :-)

Of course, users with identical UIDs have damn near zero security
against one another even if the UID in question _isn't_ root, so I
don't really consider this a problem.  (Okay, okay, one can probably
construct examples with chroot and such where there is some security
between such users; I think my point is fairly clear anyway.)

> Also, if you su to root, then rsh, this code will use the old value
> of USER, unless [...].  This could occasionally be suprising.

Also true.  This did not bother me, because the user for which these
executables got used was a superuser login that was used for login, not
for su, purposes.

					der Mouse

			       mouse@rodents.montreal.qc.ca
		     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B