How come /sbin/nologin is in /etc/shells contradicting the man page?

[Stephen John Smoogen]

On 5/22/07, Daniel J Walsh <dwalsh at redhat.com> wrote:
> Matthias Clasen wrote:
> > On Tue, 2007-05-22 at 14:03 -0400, Daniel J Walsh wrote:
> >
> >
> >>>
> >>>
> >> I guess a better question would be how to tell the difference between a
> >> valid "user" and a "service" on the system.  Currently SELinux checks if
> >> uid < 500 (GID_MIN from /etc/login.defs) or a shell from /etc/shells -
> >> /sbin/nologin.
> >>
> >> This is used to make sure the labeling of the home directory is done
> >> properly.
> >>
> >
> > The same issue has come up in gdm recently, where a database user showed
> > up in the user list, because it was > 500 and had a "valid shell" (which
> > was /sbin/nologin). We have changed gdm to not consider nologin a valid
> > shell even if it is in /etc/shells.
> >
> > This is all a bit of an undefined mess of traditional behaviours...
> >
> >
> Steve Grubb, found this bugzilla
>
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=53963
>
> Which discusses the addition.
>
>

A fix I had to do at a certain location was to basically have a
badlogin and a nologin. The nologin was in the /etc/shells and the
badlogin was not.


-- 
Stephen J Smoogen. -- CSIRT/Linux System Administrator
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"