Bug 783631

Summary:	keystrokes recorded into btmp?
Product:	[Fedora] Fedora	Reporter:	Tsan-Kuang Lee <redhat>
Component:	kernel	Assignee:	Kernel Maintainer List <kernel-maint>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	15	CC:	gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda, redhat
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-01-21 08:15:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Tsan-Kuang Lee 2012-01-21 07:56:04 UTC

Description of problem:

After I upgraded to kernel 2.6.41.9-1.fc15.x86_64 , all my keystrokes are recorded into btmp.

Version-Release number of selected component (if applicable):

2.6.41.9-1.fc15.x86_64

How reproducible:

As long as I'm running this kernel.

Steps to Reproduce:
1. Type any keys, login into X, go to browser, etc.
2. As root, type "lastb -w" to see all the keystrokes recorded and shown under the column "username".
  
Additional info:

I reverted to the previous kernel (2.6.41.4-1.fc15.x86_64) in grub, the problem is gone.

I wonder anybody else is experiencing the same thing, or my yum is compromised.

Comment 1 Tsan-Kuang Lee 2012-01-21 08:15:16 UTC

Sorry, I failed to reproduce the problem on my machine. I think reverting to the previous kernel fixed the problem had nothing to do with the kernel itself, but the rebooting itself. Perhaps there was a LKM rootkit on my machine. I'll keep looking and submit another ticket if I have more evidence that it's the package's problem.

Sorry for the false alarm.