Public SourceMage Discussion List

[Benoit PAPILLAULT <benoit.papillault AT sourcemage.org>]

Seth Alan Woolley a écrit :
> On Tue, Feb 01, 2005 at 04:20:14PM -0600, Jeremy Blosser wrote:
>
> > On Feb 01, Benoit PAPILLAULT [benoit.papillault AT sourcemage.org] wrote:
> >
> > > Andrew reported that "0.9.3 installer doesnt install /etc/shells" (See 
> > > http://bugs.sourcemage.org/show_bug.cgi?id=8160, 0.9.3). Apparently, 
> > > none of the ISO installer did so for quite a long time.
> > >
> > > According to the shells(5) and getusershell(3) man page, this file 
> > > records the full pathname of valid login shells. It is used for security 
> > > purpose (for instance in kdm).
> > >
> > > Since we are several people working in the ISO Team right now, and thus, 
> > > it's not related only to the 0.9.3 release, I'd like to have some input 
> > > on this file, at least from our security guru!
> > >
> > > I think this file should be updated by each shell spell (bash, tcsh, 
> > > zsh, pdksh, ...) in some post-installation scripts.
> > >
> > > Inputs, comments are welcome.
> >
> > The normal usage of this is that the admin populates /etc/shells with the
> > list of shells they want users to be able to set as their login shell via
> > chsh(1).  There are occassions where you would install a shell on the
> > system, but not want users to be able to use it via chsh.  (Just like there
> > are cases where you want to install daemon on the system but not actually
> > enable it in telinit.)
> >
> > So I would suggest each shell should prompt for this, e.g. "Add /bin/foo to
> > /etc/shells?".  I'm not sure if this should default to y or n, but y is
> > probably appropriate.
>
>
> I think we should install /bin/bash and /bin/sh in /etc/shells by 
> default (because these shells are already installed by default), and 
> then make an init/xinetd-style sorcery (or grimoire) hook to auto-affect 
> /etc/shells, defaulting to not include it in /etc/shells unless it's 
> already in /etc/shells (or use a persistent variable that has a default 
> on the iso of yes for the bash spell's two "shells", which are bash and 
> a symlink to bash from sh.
>
> Alternatively, the shadow spell can install it in FINAL with /bin/bash 
> and /bin/sh if the file doesn't exist already and we can let the 
> sysadmin handle it with their standard text editor.  I really don't mind 
> which way is done, but there's an extra coolness factor if sorcery does 
> it for you (as with everything it can do for you).
>
> Seth

Thanks Seth for your input as our security team lead. I'll add a default 
 /etc/shells containing sh+bash and let spells update it if needed.

Benoit PAPILLAULT, ISO guru