<refsect1 id='note'>
<title>NOTE</title>
- <para condition="without_vendordir">
+ <para>
The only restriction placed on the login shell is that the command
- name must be listed in <filename>/etc/shells</filename>, unless the
- invoker is the superuser, and then any value may be added. An
- account with a restricted login shell may not change her login shell.
+ name must be listed in <filename>/etc/shells</filename>.
</para>
<para condition="with_vendordir">
- The only restriction placed on the login shell is that the command
- name must be listed in <filename>/etc/shells</filename>.
If this file does not exist, the definitions are taken from the files
<filename>%vendordir%/shells</filename>,
<filename>%vendordir%/shells.d/*</filename> and
<filename>/etc/shells.d/*</filename> in that order.
If <filename>/etc/shells.d/@filename@</filename> exists, then
<filename>%vendordir%/shells.d/@filename@</filename> will not be used.
+ </para>
+ <para>
If the invoker is the superuser any value may be added regardless what is
defined in the configuration files.
An account with a restricted login shell may not change her login shell.
- </para>
- <para>
For this reason, placing <filename>/bin/rsh</filename> in
<filename>/etc/shells</filename> is discouraged since accidentally
changing to a restricted shell would prevent the user from ever