Re: /etc/utmp

[mouse () collatz mcrcim mcgill edu (der Mouse)]

> > There is some code in taintperl to make sure that a symlink swap
> > hasn't taken place beneath the SUID scipt in question.  Grep the
> > perl sources for "Mail".  Larry has left a little surprise for
> > would-be hackers. :)

I did grep the perl source - version 4.036 - for Mail, and found only
one hit:

perl-4.036/emacs/tedstuff:Sender: mmdf () uvaarpa Virginia EDU (Uvaarpa Mail System)

You have to grep for "mail", or more precisely, "/bin/mail".  Or, to
perhaps save you the time, it's in perl.c (perl-4.036/perl.c, at least
for this version).

                                        der Mouse

                            mouse () collatz mcrcim mcgill edu