Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 149906

Summary: su -m doesn't work for restricted shell accounts
Product: Gentoo Linux Reporter: Don Feliciano <don.feliciano+lists>
Component: [OLD] baselayoutAssignee: Gentoo's Team for Core System packages <base-system>
Status: VERIFIED INVALID    
Severity: normal    
Priority: Normal    
Version: 2006.1   
Hardware: All   
OS: Linux   
URL: http://forums.gentoo.org/viewtopic-t-503768-highlight-.html?sid=71a50f4af2a5ce044df8a38d371cae46
Whiteboard:
Package list:
Runtime testing required: ---

Description Don Feliciano 2006-10-02 17:07:57 UTC
# su -m apache -c "echo test"
This account is currently not available.

From man page:
If the target user has a restricted shell, this option has no effect (unless su is called by root).

Since I am calling as root, I expect it to work.  I tested on OpenBSD and Red Hat and it does what I expect.

# emerge --info
Portage 2.1.1-r1 (default-linux/amd64/2006.1, gcc-4.1.1, glibc-2.4-r3, 2.6.17-gentoo-r8 x86_64)
=================================================================
System uname: 2.6.17-gentoo-r8 x86_64 Intel(R) Xeon(TM) CPU 2.80GHz
Gentoo Base System version 1.12.5
Last Sync: Mon, 02 Oct 2006 16:50:01 +0000
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.2.11-r1
dev-lang/python:     2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r4
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=nocona -O2 -fomit-frame-pointer -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /var/qmail/alias /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-march=nocona -O2 -fomit-frame-pointer -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks metadata-transfer sandbox sfperms strict"
GENTOO_MIRRORS="ftp://mirror.datapipe.net/gentoo http://gentoo.mirrors.pair.com http://mirrors.acm.cs.rpi.edu/gentoo"
MAKEOPTS="-j5"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.namerica.gentoo.org/gentoo-portage"
USE="amd64 apache2 berkdb bitmap-fonts cli crypt dlloader dri elibc_glibc fortran gdbm gpm input_devices_evdev input_devices_keyboard input_devices_mouse isdnlog kernel_linux libg++ logrotate ncurses nls nptl nptlonly pam pcre perl ppds pppd python readline reflection session smp spl ssl tcpd truetype-fonts type1-fonts udev unicode userland_GNU vhost vhosts video_cards_apm video_cards_ark video_cards_ati video_cards_chips video_cards_cirrus video_cards_cyrix video_cards_dummy video_cards_fbdev video_cards_glint video_cards_i128 video_cards_i810 video_cards_mga video_cards_neomagic video_cards_nv video_cards_rendition video_cards_s3 video_cards_s3virge video_cards_savage video_cards_siliconmotion video_cards_sis video_cards_sisusb video_cards_tdfx video_cards_tga video_cards_trident video_cards_tseng video_cards_v4l video_cards_vesa video_cards_vga video_cards_via video_cards_vmware video_cards_voodoo xorg zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 SpanKY gentoo-dev 2006-10-02 21:59:21 UTC
-m has nothing to do with it

the -c option will always use the SHELL of the specified user ... the user here is apache and the default shell is /bin/false, so `su apache -c "..."` will execute `/bin/false ...`

you need to use the -s option to specify a different shell than the default
Comment 2 Don Feliciano 2006-10-03 05:05:15 UTC
Curious that -s is not required by other UNIX/Linux.  Still, this solution works.  Thanks!