pkexec: enforce absolute shell paths

Reading /etc/shells file directly has the effect that comments are
parsed as well. If a user sets environment variable SHELL to a value
which matches one of these comments, it is passed through pkexec.

The shadow tools would not allow such a login shell, so be as strict
as shadow when it comes to parsing /etc/shell.

Signed-off-by: Tobias Stoeckmann <[email protected]>

src/programs/pkexec.c

@@ -372,7 +372,7 @@ is_valid_shell (const gchar *shell)
   shells = g_strsplit (contents, "\n", 0);
   for (n = 0; shells != NULL && shells[n] != NULL; n++)
     {
-      if (g_strcmp0 (shell, shells[n]) == 0)
+      if (shells[n][0] == '/' && g_strcmp0 (shell, shells[n]) == 0)
         {
           ret = TRUE;
           goto out;