On Mon, Jul 26, 2004 at 08:08:16PM -0400, Clint Harshaw wrote:
>
> Some time ago, I posted a question about mysterious users that showed up
> when I would do a "who" at the prompt. I have a question related to
> that issue. Is there any difference in typing "exit" to stop a terminal
> vs. clicking on the "X" in that terminal's window? I wonder if these
> extra users are due to my "X-ing" out of a terminal rather than typing
> "exit" at the prompt.
>
> Is there any harm done by "X-ing" out of the terminal?
Depends what is running under the control of the terminal.
Exit is best.
> Is there a proper way to retrieve those users remaining from a prior
> X-out so that I could "exit" from them? (short of rebooting, I can't
> seem to remove the extraneous users.)
This is a GOOD question.
There is no tool to clean them up. Rather than write a tool
we should find what process is doing 'bad' things and fix it.
As for X .vs. exit.
It has no absolute answer but 'exit' is best.
The key is how signals are handled and what applications
are involved and how well those applications tidy up when
signals are sent.
The way to explore this is by tracing the system calls
of the application. For Xterm try something like:
# strace -f -o /tmp/watch-xterm-x xterm
# strace -f -o /tmp/watch-xterm-exit xterm
In one case (exit) you will see that xterm gets to see a signal from
it's child when you type exit. In the other case X you will see a
sequence of events where the signal originates from the xserver.
In both cases you might see
open("/var/log/wtmp", O_WRONLY) = -1 EACCES (Permission denied)
so you now see the SGID utmpter program launched.
execve("/usr/sbin/utempter"
Then with gnome-terminal things get a more complex.
# strace -f -o /tmp/watch-gnometerm-x gnome-terminal
# strace -f -o /tmp/watch-gnometerm-exit gnome-terminal
It is fun to notice that a library for sound is opened by gnome
that is not opened by xterm.... lots more..
Note how SIGHUP and SIGTERM are invoked differently.
Note how the signals flow differently.
Note that these differences cause different code path entry points.
Note the different chain of dependencies to tidy up wtmp/utmp.
Some might be result of a 'zombie' process.
Look for them with fuser and ps.
>From the man page it is clear that you can remove bogus lines with a
privileged program.
Warning: utmp must not be writable, because many system programs
(fool- ishly) depend on its integrity. You risk faked system
logfiles and modifications of system files if you leave utmp
writable to any user.
--
T o m M i t c h e l l
/dev/dull where insight begins.
