Allowing users to change execvp’s shell?

[Ludovic Courtès]

Hi,

In the context of GNU Guix, I’m pondering a change that would allow
users to change the shell used by ‘execvp’ (more details about the
rationale at <http://thread.gmane.org/gmane.linux.distributions.nixos/9748>),
along these lines:

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/x-patch
Size: 381 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20121216/076c0225/attachment.bin>
-------------- next part --------------

I wonder what security implications it may have.

On GNU/Hurd, relying on a hard-coded /bin/sh doesn’t provide any
guarantee because users are free to choose the file system root of every
process they launch.  So checking for an environment variable is no worse.

On GNU/Linux, only root (or a user with CAP_SYS_CHROOT or CAP_SYS_ADMIN)
can use chroot(2) and mount(2), so /bin/sh is likely to be what the
admin’s want it to be.  OTOH, tweaking $GLIBC_SHELL doesn’t seem worse
than tweaking $PATH.

There’s the issue of setuid-root binaries.  Then again, I wonder if
these should be using execvp at all in the first place.

WDYT?

Thanks,
Ludo’.