From owner-freebsd-current@FreeBSD.ORG  Tue Feb 24 14:37:25 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8A53116A4CE
	for <freebsd-current@FreeBSD.ORG>;
	Tue, 24 Feb 2004 14:37:25 -0800 (PST)
Received: from VARK.homeunix.com (adsl-68-122-0-124.dsl.pltn13.pacbell.net
	[68.122.0.124])	by mx1.FreeBSD.org (Postfix) with ESMTP id 660D743D2D
	for <freebsd-current@FreeBSD.ORG>;
	Tue, 24 Feb 2004 14:37:25 -0800 (PST)	(envelope-from das@FreeBSD.ORG)
Received: from VARK.homeunix.com (localhost [127.0.0.1])
	by VARK.homeunix.com (8.12.11/8.12.10) with ESMTP id i1OMaxbn069864;
	Tue, 24 Feb 2004 14:36:59 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Received: (from das@localhost)
	by VARK.homeunix.com (8.12.11/8.12.10/Submit) id i1OMaxO5069863;
	Tue, 24 Feb 2004 14:36:59 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Date: Tue, 24 Feb 2004 14:36:59 -0800
From: David Schultz <das@FreeBSD.ORG>
To: Colin Percival <colin.percival@wadham.ox.ac.uk>
Message-ID: <20040224223659.GB69570@VARK.homeunix.com>
Mail-Followup-To: Colin Percival <colin.percival@wadham.ox.ac.uk>,
	freebsd-current@FreeBSD.ORG
References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca>
cc: freebsd-current@FreeBSD.ORG
Subject: Re: What to do about nologin(8)?
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Feb 2004 22:37:25 -0000

On Mon, Feb 23, 2004, Colin Percival wrote:
>   I can see a number of possible options; I'd like to hear
> opinions on which would be the best.

This is the third time this issue has been discussed, so before
the same arguments are rehashed, I'd like to lay out a simple plan
that I think people are unlikely to object to.  (If anyone *does*
object, please say so.)

(1) Fix login(1) so that it disables the -p option when the target
    user's shell is not in /etc/shells (unless the invoking user
    is root), and

(2) Make nologin(8) setgid nobody, so rtld ignores LD_LIBRARY_PATH.

After that, people are welcome to debate whether to make nologin
dynamically linked again (which should be safe), whether to move
it to /usr/sbin (which sounds reasonable, but won't matter as much
anymore), and whatnot.  I just don't want to (once again) get into
a big debate that ends up getting derailed so that nobody gets
anything done.


P.S. Both of these ideas are due to Tim Kientzle.