>Number:         18282
>Category:       lib
>Synopsis:       uncorrect /var/run/utmpx file owner and group, and modes
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 13 07:40:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Ryo HAYASAKA
>Release:        NetBSD 1.6H
>Organization:
Japan Advanced Institute of Science and Technology (JAIST)
>Environment:
System: NetBSD bonnie.jaist.ac.jp 1.6H NetBSD 1.6H (BONNIE) #313: Wed Sep 11 22:35:49 JST 2002 ryoh@bonnie.jaist.ac.jp:/usr/src/sys/arch/i386/compile/BONNIE i386
Architecture: i386
Machine: i386
>Description:
I often get the following message in "daily insecurity output."

Checking special files and directories.
var/run/utmpx: 
	gid (45, 0)

This is because the file group and modes of /var/run/utmpx are not
correct.

$ ls -l /var/run/utmpx
-rw-r--r--  1 root  wheel  1024 Sep 13 22:17 /var/run/utmpx

The correct output should be:

-rw-rw-r--  1 root  utmp  1024 Sep 13 22:17 /var/run/utmpx
	
>How-To-Repeat:
$ ls -l /var/run/utmpx
	
>Fix:
I am not sure this diff is a correct fix, but this just works.

Index: utmpx.c
===================================================================
RCS file: /usr/cvsup/basesrc/lib/libc/gen/utmpx.c,v
retrieving revision 1.10
diff -d -p -u -r1.10 utmpx.c
--- utmpx.c 2002/07/28 00:45:11     1.10
+++ utmpx.c 2002/09/13 13:37:56
@@ -108,7 +108,11 @@ getutxent()
                        goto failclose;
 
                if (st.st_size == 0) {
-                       /* new file, add signature record */
+                       /* new file */
+                       /* set file owner and group, and modes */
+                       (void)fchown(fileno(fp), (uid_t)0, (gid_t)45);
+                       (void)fchmod(fileno(fp), 0664);
+                       /* add signature record */
                        (void)memset(&ut, 0, sizeof(ut));
                        ut.ut_type = SIGNATURE;
                        (void)memcpy(ut.ut_user, vers, sizeof(vers));
	
>Release-Note:
>Audit-Trail:
>Unformatted: