In the directory /root/ I found a file core which belongs to login program. rpm -qf /bin/login util-linux-2.10m-12 The symbols are stripped, so the trace seems not very useful, but you probably can extract the real trace by re-linking login with debugging symbols. ls -l core -rw------- 1 root root 491520 Feb 20 12:43 core gdb /bin/login core .... (gdb) bt #0 strncpy (s1=0xbfffd61c "", s2=0x0, n=32) at ../sysdeps/generic/strncpy.c:41 #1 0x8049e6e in strcpy () at ../sysdeps/generic/strcpy.c:31 #2 0x7974742f in ?? () Cannot access memory at address 0x7665642f (gdb) I can not tell why it happened, I just found a core file. This may be a security problem, because if login has some buffer overflow this will compromize everything. The core is definitely from /bin/login: #strings core |less CORE CORE login login CORE login CORE failure forking: %s setuid() failed No directory %s! Logging in with home = "/". login: no memory for shell script. exec login: couldn't exec shell script: %s. login: no shell: %s. .....
This one is easy to reproduce: - Login as normal user - type 'login' - hit CTRL-D a few times --> core dump
Upgrade to pam-0.74-12 fixed this