From xaa@stack.nl  Thu Jan 14 12:45:48 1999
Received: from mailhost.stack.nl (terra.stack.nl [131.155.140.128])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id MAA05090
          for <FreeBSD-gnats-submit@freebsd.org>; Thu, 14 Jan 1999 12:45:47 -0800 (PST)
          (envelope-from xaa@stack.nl)
Received: from toad.stack.nl (toad.stack.nl [131.155.140.135])
	by mailhost.stack.nl (Postfix) with ESMTP
	id CE3C82F61; Thu, 14 Jan 1999 21:44:32 +0100 (MET)
Received: by toad.stack.nl (Postfix, from userid 239)
	id 9A3BC965E; Thu, 14 Jan 1999 21:44:34 +0100 (CET)
Message-Id: <19990114204434.9A3BC965E@toad.stack.nl>
Date: Thu, 14 Jan 1999 21:44:34 +0100 (CET)
From: xaa@xaa.iae.nl
Sender: xaa@stack.nl
Reply-To: xaa@xaa.iae.nl
To: FreeBSD-gnats-submit@freebsd.org
Subject: su doesn't check login.conf's shell and its validity
X-Send-Pr-Version: 3.2

>Number:         9495
>Category:       bin
>Synopsis:       su doesn't look at login.cnf all the time
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jan 14 12:50:00 PST 1999
>Closed-Date:    Sun Jun 17 00:03:49 PDT 2001
>Last-Modified:  Sun Jun 17 00:04:38 PDT 2001
>Originator:     Mark Huizer
>Release:        FreeBSD 2.2.7-STABLE i386
>Organization:
MCGV Stack
>Environment:

	2.2.7 (and current as well)

>Description:

	if a user is given an illegal shell in /etc/login.conf (e.g. for
	a login class called 'lockout'), su will happily su to that
	user. This should not be allowed if a mortal user su's to
	another mortal user.

>How-To-Repeat:

	create loginclass with e.g. /bin/false as shell, su to that
	user, yeah... 

>Fix:
	see Q&D patch to su.c:

355a356,360
> #ifdef LOGIN_CAP
> 		if (!chshell(login_getcapstr(lc, "shell", pwd->pw_shell, pwd->pw_shell)) && ruid)
> 			errx(1, "permission denied (shell).");
> 		else
> #endif
366a372
> 

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: mikeh 
State-Changed-When: Sun Jun 17 00:03:49 PDT 2001 
State-Changed-Why:  
Many changes have been made since then. If this is still a problem 
please file another PR. 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=9495 
>Unformatted:
