Hello,
On Debian 13 (coreutils 9.7-3, systemd/libsystemd0 257.13-1~deb13u1), I observed a stale SSH session reappear in who when its former leader PID was reused by an unrelated Apache worker. The session was created on July 22, 2026, and remained in the closing state with a detached Screen and a monitoring script in its scope: Id=151944 Name=pzygmunt Timestamp=Wed 2026-07-22 17:38:10 CEST Service=sshd Scope=session-151944.scope Leader=2120141 Class=user State=closing On September 21 at 23:12:21 CEST, who started reporting: pzygmunt sshd Jul 22 17:38 (192.0.2.10) (The remote address is anonymized.) who -u reported PID 2120141. A process snapshot showed that this PID now belonged to www-data: PID: 2120141 PPID: 132018 Start: Mon Sep 21 23:12:20 2026 Command: /usr/sbin/apache2 -k start At 23:14:04 the Apache process was absent and the who entry disappeared, while loginctl still listed session 151944 with the same Leader. No SSH authentication was recorded in the examined interval. This produced a false logged-in-user alert in monitoring. readutmp's systemd backend uses the session leader PID. The subsequent kill(pid, 0) existence check cannot distinguish a reused PID from the original leader. The attached proposed patch skips sessions whose state is closing when READ_UTMP_CHECK_PIDS is requested. Calls without that flag are unchanged. If sd_session_get_state fails, the existing behavior is retained. Base revision supplied by my checkout: 92d4a0deb5f8f332d3ea800f8fb41d0b56b4169a The patch was prepared against lib/readutmp.c from that checkout. Validation so far: - git apply --check against the supplied source succeeds. - A standalone C test of the inserted block passes for closing, active, online, opening, unknown states, API failure, and calls without CHECK_PIDS. - No complete gnulib/coreutils build or end-to-end reproduction with the patched who has been performed yet. The standalone test is not integrated into the gnulib test suite. Would filtering closing sessions under READ_UTMP_CHECK_PIDS be appropriate, or would you prefer validation of the leader's association with the session? This is an RFC: in particular, it intentionally excludes closing sessions under this flag even if their original leader has not exited yet. Best regards, Przemyslaw Zygmunt
readutmp-closing-session.patch
Description: Binary data
