From owner-freebsd-current@FreeBSD.ORG  Tue Feb 24 17:43:30 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id E993816A4CE; Tue, 24 Feb 2004 17:43:30 -0800 (PST)
Received: from VARK.homeunix.com (adsl-68-122-0-124.dsl.pltn13.pacbell.net
	[68.122.0.124])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id C24A943D1D; Tue, 24 Feb 2004 17:43:30 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Received: from VARK.homeunix.com (localhost [127.0.0.1])
	by VARK.homeunix.com (8.12.11/8.12.10) with ESMTP id i1P1h4oB070652;
	Tue, 24 Feb 2004 17:43:04 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Received: (from das@localhost)
	by VARK.homeunix.com (8.12.11/8.12.10/Submit) id i1P1h4g6070651;
	Tue, 24 Feb 2004 17:43:04 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Date: Tue, 24 Feb 2004 17:43:04 -0800
From: David Schultz <das@FreeBSD.ORG>
To: Colin Percival <colin.percival@wadham.ox.ac.uk>
Message-ID: <20040225014304.GA70480@VARK.homeunix.com>
Mail-Followup-To: Colin Percival <colin.percival@wadham.ox.ac.uk>,
	freebsd-current@FreeBSD.ORG, nectar@FreeBSD.ORG
References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca>
	<20040224223659.GB69570@VARK.homeunix.com>
	<6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca>
cc: nectar@FreeBSD.ORG
cc: freebsd-current@FreeBSD.ORG
Subject: Re: What to do about nologin(8)?
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Feb 2004 01:43:31 -0000

On Tue, Feb 24, 2004, Colin Percival wrote:
> At 22:36 24/02/2004, David Schultz wrote:
> >This is the third time this issue has been discussed, so before
> >the same arguments are rehashed, I'd like to lay out a simple plan
> >that I think people are unlikely to object to.  (If anyone *does*
> >object, please say so.)
> 
>   I object. :)
> 
> >(1) Fix login(1) so that it disables the -p option when the target
> >    user's shell is not in /etc/shells (unless the invoking user
> >    is root)
> 
>   Adding /sbin/nologin to /etc/shells is a standard way to create
> ftp-only users.  This may or may not be the appropriate solution,
> but it is widely used.

Umm...I never claimed that this would completely fix the world's
environment poisoning problems.  You seem to be objecting to
fixing a bug on the grounds that some people won't notice that the
bug is gone.  (Note that it *is* a bug that 'login -p' works for
users with nonstandard shells; see the CVS log for su for details.)

> >(2) Make nologin(8) setgid nobody, so rtld ignores LD_LIBRARY_PATH.
> 
>   Wearing my member-of-security-team hat, I have to say I'm rather
> unhappy with this idea.  It's also been pointed out (by nectar) that
> there are issues with NFS if files are owned by nobody or nogroup.

What's the problem with uid=root, gid=nogroup, perm=755?