From owner-freebsd-current@FreeBSD.ORG Thu Feb 26 14:47:48 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0E97E16A4CE for ; Thu, 26 Feb 2004 14:47:48 -0800 (PST) Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5B64643D39 for ; Thu, 26 Feb 2004 14:47:47 -0800 (PST) (envelope-from ache@pobrecita.freebsd.ru) Received: from pobrecita.freebsd.ru (ache@localhost [127.0.0.1]) by nagual.pp.ru (8.12.11/8.12.11) with ESMTP id i1QMljKF073608; Fri, 27 Feb 2004 01:47:45 +0300 (MSK) (envelope-from ache@pobrecita.freebsd.ru) Received: (from ache@localhost) by pobrecita.freebsd.ru (8.12.11/8.12.11/Submit) id i1QMljiQ073607; Fri, 27 Feb 2004 01:47:45 +0300 (MSK) (envelope-from ache) Date: Fri, 27 Feb 2004 01:47:45 +0300 From: Andrey Chernov To: Arne Schwabe Message-ID: <20040226224744.GA73252@nagual.pp.ru> Mail-Followup-To: Andrey Chernov , Arne Schwabe , Colin Percival , freebsd-current@FreeBSD.ORG References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <20040223231219.GA83154@nagual.pp.ru> <86hdxdapla.fsf@kamino.rfc1149.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <86hdxdapla.fsf@kamino.rfc1149.org> User-Agent: Mutt/1.5.6i X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.24.0.5; VDF 6.24.0.20 cc: freebsd-current@FreeBSD.ORG cc: Colin Percival Subject: Re: What to do about nologin(8)? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Feb 2004 22:47:48 -0000 On Thu, Feb 26, 2004 at 03:21:37PM +0100, Arne Schwabe wrote: > Andrey Chernov writes: > > > On Mon, Feb 23, 2004 at 05:45:07PM +0000, Colin Percival wrote: > >> For security reasons, nologin(8) must be statically linked; > > > > What that mystical reasons are, exactly? I see no one while it is not have > > s-bit set. At least -current /sbin is dynamically linked, so nologin must > > too. > > See for example: http://www.mindsec.com/files/5JP0H2A7PW.html As I already say many times, this is not nologin problem, repeat, no problem with nologin, _all_ 3rd party shells and scripts suffer because of this, it should be fixed in the caller, not in the shell. Even if you "fix" nologin, what home-made shell comes next? -- Andrey Chernov | http://ache.pp.ru/