FreeBSD last(1) wrapper which protects the privacy of other users

last.sh

#! /bin/bash
# THIS RUNS SETGID utmp
# last [-[n ]number] [user]
# everything else is IGNORED.

PROC=$_

### Only allow invocation from last, not other procs
if [ "${PROC/last/}" = "${PROC}" ]; then
  exit 1
fi



PATH=/usr/local/bin:/usr/bin:/bin

whoami=$(/usr/bin/id -un)

if [ "${whoami}" = "root" ] ; then
  exec /usr/bin/nice /usr/bin/last "$@"
fi

#Check the first char for a '-'

numbers=""
# now get the last option, allow reboot or same user.
if [ $# -gt 1 -o "${1:0:1}" = "-" ]; then
  for ((i=0;i < $#;i++)); do
    if [ "${1:0:1}" = "-" ]; then
      #Parse out numbers
      if [ "${1:0:2}" = "-n" ]; then
        #Check if there is a next argument, otherwise it's hax
        if [ $(($i + 2)) -lt $# ]; then
          shift 1
          #although this $1 could not be a number, the real 'last' will throw an error
          numbers="-n $1"
        else
          numbers="$1"

          # 'last -n 1' will cause this case to come up
          if [ "$1" = "-n" ]; then
            echo "$2"|/usr/bin/grep '^[0-9]*$' > /dev/null 2>&1
            if [ $? -eq 0 ]; then
              numbers="$1 $2"
              shift 1
            fi
          fi
        fi
      else
        #Use grep to see if this matches "-[0-9]*"
        echo "$1"|/usr/bin/grep '^\-[0-9]*$' > /dev/null 2>&1
        if [ $? -eq 0 ]; then
          numbers="$1"
        fi
      fi

    fi
    shift 1
  done
fi

usr="$1"
if [ -z "$usr" ]; then
  usr="${whoami}"
fi

if [ -z "$usr" -o "$usr" = "reboot" -o "$usr" = "${whoami}" ]; then
  exec /usr/bin/nice /usr/bin/last "${numbers}" "$usr"
else
  echo "Error: Invalid options/user specified."
  echo "This is a wrapper around FreeBSD's last(1) command, which protects the privacy of other users."
  echo "Usage: last [-n number] ${whoami}"
  exit 1
fi

This ugly hack is intended to run via a setgid c wrapper located in /usr/local/bin/last. This wrapper executes the hidden sh wrapper (only executable by group utmp). The utmp/wtmp files are also only readable by group utmp.

If possible, patch your /usr/src instead with this: https://github.com/bdrewery/FreeBSD-usr.bin-last

A more updated patch is available at http://lists.freebsd.org/pipermail/freebsd-hackers/2012-June/039054.html

It's a work in progress to get this into base.