[SSSD] NSS - use of allowed_shells

Pavel Reichl preichl at redhat.com
Thu Oct 2 12:24:55 UTC 2014


Hello,

We have a user whose use-case seems quite legit to me but is impossible 
to be achieved without changing the code. 
(https://fedorahosted.org/sssd/ticket/2219)

What user wants: in case that user's shell is not in /etc/shells he 
simply wants to use value of 'shell_fallback' option as user's shell.

This can be achieved if the user's shell is in 'allowed_shells' option, 
but to maintain this option to enumerate all possible shells is not very 
convenient when you got huge heterogeneous network for different 
projects with different administrators.

Instead the user proposed a patch adding special value '*' to 
'allowed_shells' which would mean that any user's shell is a member of 
'allowed_shells'.

I believe that the patch will work, but the solution will IMO complicate 
the shell magic even more.

Could we change the code so in case when user's shell is not in 
/etc/shells and 'allowed_shells' is empty to use 'shell_fallback'? Or do 
you find the '*' as a better option?

Thanks!





More information about the sssd-devel mailing list