On 7/22/13 4:43 PM, Maura Dailey wrote:
+ <ind:pattern operation="pattern
match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
Is this still outstanding?
My original thinking was that only the 'halt' user should have
/sbin/halt as an acceptable shell, only 'shutdown' should have
/sbin/shutdown, etc, however the security gains for this seem incredibly
trivial.
This is a marked improvement. If someone has a strong enough opinion on
only having /sbin/halt assigned to halt, patches welcome :)
Ack from me.