
The Unix `Who` Command - warenhor
https://gauthier.uk/blog/who/
======
tptacek
It's funny to me, because the way I came up in Unix, `utmp` was one of the
_first_ things you learned about: you were using Unix not because you
installed it but because every system you might want to break into (for
instance, to get to IRC through an outdial or a gateway) was running it, and
they were all multi-user shell machines, and you wanted to make sure you
weren't showing up in `who`. I probably knew the `utmp` format before I knew
how to use `find`.

You'll find, in archives from hacking sites of the era, a whole variety of
"utmp editors".

~~~
JdeBP
Thanks to setlogin()/getlogin() some operating systems are frustratingly close
to the point where all of the relevant information can be read straight out of
the kernel's process table, without need for coöperatively maintaining a data
file.

On FreeBSD, for example, one can do everything except filter out the terminals
where no-one is logged on yet and print a "FROM" column.

------
cptnapalm
Understanding UNIX/LINUX Programming: A Guide to Theory and Practice by Bruce
Molay is a work which has the reader learn system programming by re-
implementing UNIX commands.

who is the focus of Chapter 2.

~~~
lovehashbrowns
How useful is that book nowadays? Is it still worth purchasing?

~~~
audiometry
Yeah wondering if this would be interesting to do as a recreation project. Is
copyright 2003 and mostly unvailable -- Amazon dares to "rent" it to me for
45$.... give me a break.

------
eesmith
I was confused - is "who mom hates" supposed to do something interesting?

On my Mac it seems any two arguments are allowed as an alias for "am i", so
long as the first doesn't start with "-".

Looking it up, [https://unix.stackexchange.com/questions/108145/is-who-
mom-l...](https://unix.stackexchange.com/questions/108145/is-who-mom-likes-a-
real-linux-command) suggests it's a well-known in-joke.

FWIW, on my FreeBSD machine, only "who am i"/"who am I" are allowed.

~~~
dredmorbius
Any two non-option arguments returns the user of the invoking tty. "who is
awesome" or "who foo bar" achieves the same result.

------
peter_retief
I love your simple demonstration of strace reverse engineering a UNIX command.
Probably a very silly question but I get this compile error? mywho.c:8:13:
error: use of undeclared identifier 'LC_ALL' setlocale(LC_ALL, ""); I should
solve it myself but since you are here?

~~~
forgotpwd16
Not the author as I had the same issue, add `#include <locale.h>` after the
other headers.

~~~
peter_retief
Thanks for the help! It works!

------
iso1210
I was hoping to see why who was better than w or similar, instead I was
pleasently surprised to find someone taking a really simple unix command,
reverse engineering it, and reimplementing it

------
dn3500
The comment "initialize the utmp structure" is wrong. You have declared the
struct here but it is uninitialized.

And there is no point in setting the locale, since your program never uses it.

------
neallindsay
I was legitimately confused for a second when I saw `Who` capitalized, but it
must have been some automatic HN formatting - it's lower-case is the linked
blog post.

------
formerly_proven
who is 66 % waste: w is 300 % shorter and shows up to 721 % more valuable
information.

~~~
x87678r
who shows where the session is coming from which is useful for me where random
people connect with the same system account.

(OK w -f shows this)

~~~
salawat
There's something delightfully absurd about invoking who and getting told
where they're logging in from. There's an Abbot and Costello skit in there
waiting to come out.

This is why I love computing. It's putting abject insanity to good use.

------
Tepix
Nice article. Reading the ‚who(1)‘ manpage would also have revealed ‚utmp‘ to
be the relevant file, of course.

------
indigodaddy
I’ve found grep to be unreliable or behave unexpectedly with strace. Even when
piping to strings first, although not sure if that is of any consequence.
Anyone know why that is or experienced the same?

~~~
dn3500
You know it outputs to stderr, right? Also if you give it the option "-o -" it
doesn't do what you might expect. Other than that I grep the output of strace
all the time and it works for me.

------
chard_slicks_
His "who" implementation is 73 lines (21 if you remove blank lines and
comments). Compare that to 836 in GNU Coreutils[0].

[0]
[https://github.com/coreutils/coreutils/blob/master/src/who.c](https://github.com/coreutils/coreutils/blob/master/src/who.c)

~~~
MisterTea
plan 9 who is a 3 line shell script that just greps the output of ps and sorts
it. You could eliminate ps and just grep through /proc but why reinvent the
wheel when an existing tool already does part of the job?

I see some comments here citing a lack of options, most of which appear to
have nothing to do with who is logged into the machine.

~~~
fizzled
Is /proc as portable as `ps`?

~~~
JdeBP
There's a long explanation when it comes to ps, but the _very short_ answer is
twofold:

* Don't parse the output of ps, unless it is my ps command (or plan 9's one, as here). See [https://unix.stackexchange.com/a/593198/5132](https://unix.stackexchange.com/a/593198/5132) and [https://unix.stackexchange.com/a/578816/5132](https://unix.stackexchange.com/a/578816/5132) , and their further reading, especially Greg Wooledge's article.

* /proc is as portable as ps, but that doesn't really amount to much because _neither_ is really portable at all. Pretty much every operating system's /proc is different; and no implementation of the ps command fully conforms to even the limited subset laid out in the Single Unix Specification.

