From owner-cvs-all Sun Oct 13 11:32: 0 2002 Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 536B337B401; Sun, 13 Oct 2002 11:31:59 -0700 (PDT) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 77D0D43E97; Sun, 13 Oct 2002 11:31:58 -0700 (PDT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.12.4/8.12.4) with SMTP id g9DIVPOo038574; Sun, 13 Oct 2002 14:31:25 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Sun, 13 Oct 2002 14:31:24 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: "M. Warner Losh" Cc: mark@grondar.za, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/etc group In-Reply-To: <20021013.121741.61891248.imp@bsdimp.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sun, 13 Oct 2002, M. Warner Losh wrote: > In message: > Robert Watson writes: > : Currently, it is, I believe. I was sure at one point that we supported a > : mode of operation for su that allowed any user to su to root if the wheel > : group was empty, and restricted it to the wheel group if it was non-empty. > > FreeBSD 4.5 definitely behaves this way, and I would be really horked if > 5.0-RELEASE doesn't have some way to get a similar result. I believe you accomplish it in the New World Order by dropping pam_wheel from the /etc/pam.d/su requirements. So I'm guessing that the current /etc/group arrangement with root appearing in both wheel and operator is the right one for the time being. Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Network Associates Laboratories To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message