problem with rbash and su

[Shawn Lamson <slnj@optonline.net>]

Hi

It seems that if I set up a user "baduser" with home directory /home/baduser and shell /bin/rbash
then when that user logs in they cannot cd nor execute commands with "/".  This is what one would expect.

However if that baduser uses "#su - baduser" to again login from their shell then they can cd anywhere they may have permissions (group perms for example) and can execute commands with "/" in them... basically all of the protections of rbash are gone... the shell running is in fact rbash though... here is the output of ps.

BTW my example is for remote users... but this same baduser could walk up to anyones desk and use anyones shell (console, xterm) to simply "su - baduser" , give their password, and they are able to bypass the goodness of the rbash restrictions... 

Is this a bug?  Something I didn't configure (obviously I can do a lot of other things to limit the user)? If a bug - against rbash/bash or against su/login? 

I did google briefly and also checked outstanding bash bugs on bugs.debian.org but didn't see this come up.

I am running sid/unstable with  login version Version: 1:4.0.14-4 and bash Version: 3.1-2 

Pretty easy for anyone to set this up and test... or am i missing something?

Thanks

----------
Shawn Lamson
slnj@optonline.net