Re: System users and valid shells...
Gabor Gombas wrote:
> On Mon, May 08, 2006 at 10:00:42AM +0100, Thiemo Seufer wrote:
>
> > > You can surely explain why /bin/nologin is more secure than
> > > /bin/false. I'm eager to learn.
> >
> > I am curious why any of both would be more secure than /dev/null, a
> > place which makes it hard to smuggle an infected binary into.
>
> If the attacker has enough privileges to replace /bin/nologin or
> /bin/false, then I fail to see what extra protection would /dev/null
> give.
s/smuggle an infected/install a broken/ , doesn't change the point
I wanted to make.
> Also, applications expecting an executable binary as the login shell may
> break when they find a device node there. And if the breakage is
> exploitable, then using /dev/null may turn out to be less secure than
> using /bin/bash.
Such a binary is completely broken, and it would fail in a similiar way
for any sort of file it has no execute permission for, not only for
$SHELL.
Thiemo
Reply to: