Bug 80345 – correct use of SU_WHEEL_ONLY in sys-apps/shadow

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Gregorio Guidi (RETIRED) 2005-02-01 07:50:18 UTC]

The current ebuilds for shadow apply a pacth (shadow-4.0.5-login.defs.patch)
that sets the default value for SU_WHEEL_ONLY to yes.
This applies to non-PAM systems, and was intended to match the
behaviour of PAM systems, where pam_wheel is enabled by default (that's 
explained in the handbook, too).

However, the result is not the same: the implementation of SU_WHEEL_ONLY in
shadow is such that only users in the group with gid=0 can su to root, and
not users belonging to the wheel group.

I think we should apply the following patch, which changes the behaviour of
SU_WHEEL_ONLY to match PAM (and to be consistent with its name).

Maybe this should be also submitted upstream?

[Comment 1 Gregorio Guidi (RETIRED) 2005-02-01 07:50:58 UTC]

Created attachment 50134 [details, diff]
shadow-4.0.7-wheel.patch

[Comment 2 SpanKY 2005-02-06 15:41:32 UTC]

added 4.0.7 w/patch & e-mailed patch upstream, thanks

[Comment 3 Gregorio Guidi (RETIRED) 2005-02-10 03:16:48 UTC]

*** Bug 81175 has been marked as a duplicate of this bug. ***

[Comment 4 Adam 2005-02-10 13:05:12 UTC]

Rather than patching su, how about installing a file /etc/suauth containing the line:
root:ALL EXCEPT GROUP wheel:DENY
and leaving SU_WHEEL_ONLY as no?

See man suauth for details on what this does.