RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1811794 - tlog-rec-session does not create an utmp entry, leading the “who am i” command to fail
Summary: tlog-rec-session does not create an utmp entry, leading the “who am i” comman...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: tlog
Version: 8.1
Hardware: All
OS: Linux
low
low
Target Milestone: rc
: 8.4
Assignee: jstephen
QA Contact: Scott Poore
URL:
Whiteboard: sync-to-jira
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-09 19:10 UTC by Carlos Santos
Modified: 2021-05-18 15:24 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-18 15:24:35 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github Scribery tlog issues 280 0 None open tlog-rec-session does not create an utmp entry, leading the “who am i” command to fail 2021-02-12 17:59:20 UTC
Github Scribery tlog pull 317 0 None closed test_tlog_rec_session: add utmp test case 2021-02-12 17:59:20 UTC
Red Hat Product Errata RHBA-2021:1766 0 None None None 2021-05-18 15:24:39 UTC

Description Carlos Santos 2020-03-09 19:10:38 UTC
Description of problem:

After terminal logging is enabled in sssd the user loses the ability to run the command "who am i" command.

Version-Release number of selected component (if applicable):

tlog-6-1.el8.x86_64

How reproducible:

Always

Steps to Reproduce:

1. follow the steps here to install and configure session recording

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/recording_sessions/index

2. Add user "newuser" and enable session recording for him

# grep newuser /etc/passwd
newuser:x:1001:1001::/home/newuser:/bin/bash

# cat /etc/sssd/conf.d/sssd-session-recording.conf
[session_recording]
scope=some
users=newuser
groups=

# getent passwd newuser
newuser:x:1001:1001::/home/newuser:/usr/bin/tlog-rec-session

3. restart sssd and su to user newuser

Actual results:
--------------------
$ whoami
newuser
$ who am i
<no output>
--------------------

Expected results:
--------------------
$ whoami
newuser
$ who am i
newuser     tty1      2020-02-24 15:18
--------------------

Additional info:

The problem happens because tlog-rec-session allocates a new pseudo-terminal
for the recorded user session. Since the "who" command searches for an entry
corresponding the current terminal in the run/utmp file, that search always
fails.

--------------------
# who
root     pts/0        2020-02-26 17:57 (192.168.122.1)
# tty
/dev/pts/0
# su - newuser
Locale charset is ANSI_X3.4-1968 (ASCII)
Assuming locale environment is lost and charset is UTF-8

ATTENTION! Your session is being recorded!

$ id
uid=1001(newuser) gid=1001(newuser) groups=1001(newuser) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
$ tty
/dev/pts/1
$ ps aufwww|head -n 6
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      8947  0.0  0.2  26712  5224 pts/0    Ss   17:57   0:00 -bash
root      9356  0.0  0.5 187336 10648 pts/0    S+   18:08   0:00  \_ su - newuser
tlog      9357  0.0  0.4 121780  7488 pts/0    S+   18:08   0:00      \_ -tlog-rec-session
newuser   9358  0.0  0.2  24564  5208 pts/1    Ss   18:08   0:00          \_ -bash
newuser   9436  0.0  0.2  57180  3964 pts/1    R+   18:11   0:00              \_ ps aufwww
$ who am i
$ 
--------------------

The solution requires modifying tlog-rec-session to add an entry in the utmp
file so the heuristics used by the who command succeeds.

Comment 1 jstephen 2020-03-18 15:46:30 UTC
Thank you for reporting this issue. This looks like a a lower priority from the development side, so I don't think this work will be done in the next release. I will work on it as soon as I can, or contributions are welcome.

-Justin

Comment 3 Carlos Santos 2020-03-27 17:23:31 UTC
I just submitted a solution draft:

  https://github.com/Scribery/tlog/pull/285

Comment 12 Scott Poore 2020-11-19 17:46:08 UTC
Verified

Version ::

tlog-9-2.el8.x86_64

Results ::

# usermod -s /usr/bin/tlog-rec-session testuser

# ssh testuser@localhost
The authenticity of host 'localhost (::1)' can't be established.
...
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
testuser@localhost's password: 

Activate the web console with: systemctl enable --now cockpit.socket

This system is not registered to Red Hat Insights. See https://cloud.redhat.com/
To register this system, run: insights-client --register


ATTENTION! Your session is being recorded!

$ who am i
testuser pts/2        2020-11-19 12:39

Comment 14 errata-xmlrpc 2021-05-18 15:24:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (tlog bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1766


Note You need to log in before you can comment on or make changes to this bug.