Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] ISO installer and /etc/shells

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Benoit PAPILLAULT <benoit.papillault AT sourcemage.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] ISO installer and /etc/shells
  • Date: Sat, 05 Feb 2005 21:53:07 +0100

Seth Alan Woolley a écrit :
On Tue, Feb 01, 2005 at 04:20:14PM -0600, Jeremy Blosser wrote:

On Feb 01, Benoit PAPILLAULT [benoit.papillault AT sourcemage.org] wrote:

Andrew reported that "0.9.3 installer doesnt install /etc/shells" (See http://bugs.sourcemage.org/show_bug.cgi?id=8160, 0.9.3). Apparently, none of the ISO installer did so for quite a long time.

According to the shells(5) and getusershell(3) man page, this file records the full pathname of valid login shells. It is used for security purpose (for instance in kdm).

Since we are several people working in the ISO Team right now, and thus, it's not related only to the 0.9.3 release, I'd like to have some input on this file, at least from our security guru!

I think this file should be updated by each shell spell (bash, tcsh, zsh, pdksh, ...) in some post-installation scripts.

Inputs, comments are welcome.

The normal usage of this is that the admin populates /etc/shells with the
list of shells they want users to be able to set as their login shell via
chsh(1). There are occassions where you would install a shell on the
system, but not want users to be able to use it via chsh. (Just like there
are cases where you want to install daemon on the system but not actually
enable it in telinit.)

So I would suggest each shell should prompt for this, e.g. "Add /bin/foo to
/etc/shells?". I'm not sure if this should default to y or n, but y is
probably appropriate.


I think we should install /bin/bash and /bin/sh in /etc/shells by default (because these shells are already installed by default), and then make an init/xinetd-style sorcery (or grimoire) hook to auto-affect /etc/shells, defaulting to not include it in /etc/shells unless it's already in /etc/shells (or use a persistent variable that has a default on the iso of yes for the bash spell's two "shells", which are bash and a symlink to bash from sh.

Alternatively, the shadow spell can install it in FINAL with /bin/bash and /bin/sh if the file doesn't exist already and we can let the sysadmin handle it with their standard text editor. I really don't mind which way is done, but there's an extra coolness factor if sorcery does it for you (as with everything it can do for you).

Seth

Thanks Seth for your input as our security team lead. I'll add a default /etc/shells containing sh+bash and let spells update it if needed.

Benoit PAPILLAULT, ISO guru




Archive powered by MHonArc 2.6.24.

Top of Page