Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] ISO installer and /etc/shells

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] ISO installer and /etc/shells
  • Date: Thu, 3 Feb 2005 09:16:21 -0800

On Tue, Feb 01, 2005 at 04:20:14PM -0600, Jeremy Blosser wrote:
> On Feb 01, Benoit PAPILLAULT [benoit.papillault AT sourcemage.org] wrote:
> > Andrew reported that "0.9.3 installer doesnt install /etc/shells" (See
> > http://bugs.sourcemage.org/show_bug.cgi?id=8160, 0.9.3). Apparently,
> > none of the ISO installer did so for quite a long time.
> >
> > According to the shells(5) and getusershell(3) man page, this file
> > records the full pathname of valid login shells. It is used for security
> > purpose (for instance in kdm).
> >
> > Since we are several people working in the ISO Team right now, and thus,
> > it's not related only to the 0.9.3 release, I'd like to have some input
> > on this file, at least from our security guru!
> >
> > I think this file should be updated by each shell spell (bash, tcsh,
> > zsh, pdksh, ...) in some post-installation scripts.
> >
> > Inputs, comments are welcome.
>
> The normal usage of this is that the admin populates /etc/shells with the
> list of shells they want users to be able to set as their login shell via
> chsh(1). There are occassions where you would install a shell on the
> system, but not want users to be able to use it via chsh. (Just like there
> are cases where you want to install daemon on the system but not actually
> enable it in telinit.)
>
> So I would suggest each shell should prompt for this, e.g. "Add /bin/foo to
> /etc/shells?". I'm not sure if this should default to y or n, but y is
> probably appropriate.

I think we should install /bin/bash and /bin/sh in /etc/shells by
default (because these shells are already installed by default), and
then make an init/xinetd-style sorcery (or grimoire) hook to auto-affect
/etc/shells, defaulting to not include it in /etc/shells unless it's
already in /etc/shells (or use a persistent variable that has a default
on the iso of yes for the bash spell's two "shells", which are bash and
a symlink to bash from sh.

Alternatively, the shadow spell can install it in FINAL with /bin/bash
and /bin/sh if the file doesn't exist already and we can let the
sysadmin handle it with their standard text editor. I really don't mind
which way is done, but there's an extra coolness factor if sorcery does
it for you (as with everything it can do for you).

Seth

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpv0n_dYtoCd.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page