From: Warren Young <wyml@etr-usa.com>
To: cygwin-apps@cygwin.com
Subject: Re: [RFC] /etc/shells management (fish, mksh, posh, tcsh, zsh)
Date: Thu, 12 May 2016 21:44:00 -0000 [thread overview]
Message-ID: <8D27AE89-1DF7-4570-B9AF-8A4610B52964@etr-usa.com> (raw)
In-Reply-To: <b6d3465f-6630-5e05-bd35-30fb7d005304@cygwin.com>
On May 12, 2016, at 3:36 PM, Yaakov Selkowitz <yselkowitz@cygwin.com> wrote:
>
> What are the consequences of having shells listed in /etc/shells which aren't on the system?
That file is a security feature, but the typical way Cygwin works — i.e. that normal users are allowed to install software, modify /etc/*, and so forth — nullifies its value.
But, if you do somehow lock down /etc/shells so that normal users can’t write to it, you’re also presumably locking down /bin, so a malicious user couldn’t drop in a bogus /bin/fish file and convince other software to run it as a shell.
Too bad there is no /etc/shells.d. Then non-Base shells could just add themselves there.
next prev parent reply other threads:[~2016-05-12 21:44 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <pe94jbtrjf32qn2u0mbtrful36o1trjguj@4ax.com>
[not found] ` <ngvnm4$tms$1@ger.gmane.org>
[not found] ` <lro6jbph7mumea7qcf0jbdnut23kujk3i4@4ax.com>
[not found] ` <cf899cc5-4267-3f59-478e-b7ba5361e2eb@cygwin.com>
2016-05-12 21:36 ` Yaakov Selkowitz
2016-05-12 21:44 ` Warren Young [this message]
2016-05-13 10:29 ` Andrew Schulman
2016-05-13 14:30 ` Chris Sutcliffe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8D27AE89-1DF7-4570-B9AF-8A4610B52964@etr-usa.com \
--to=wyml@etr-usa.com \
--cc=cygwin-apps@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).