From d89b4aaa64db4b2dbae7c00c3e3d4b2afbccc918 Mon Sep 17 00:00:00 2001
From: Pierre Warnier <pierre@warnier.net>
Date: Thu, 16 Apr 2026 10:43:14 +0200
Subject: [PATCH] Makefile: drop PROFILE var, fix stale comments

Address Copilot review round 2:

- Remove PROFILE variable and hardcode --release / target/release/.
  Cargo maps "dev" profile to target/debug/ (not target/dev/), so
  PROFILE=dev would silently break install. Nobody installs debug
  builds of setuid-root tools.

- Fix stale comments in Makefile and README that referenced the old
  "chmod on symlink follows through" approach. The current code uses
  install -Dm4755 directly.
---
 Makefile  | 15 +++++++--------
 README.md |  6 +++---
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/Makefile b/Makefile
index d8dd24a..21312e0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,5 @@
 PREFIX ?= /usr/local
 BINDIR ?= $(PREFIX)/sbin
-PROFILE ?= release
 
 # Tools that need setuid-root to allow non-root callers (change own password,
 # GECOS, shell, effective group).
@@ -17,10 +16,10 @@ ALL_TOOLS = $(SETUID_TOOLS) $(ROOT_TOOLS)
 all: build
 
 build:
-	cargo build --profile $(PROFILE) --workspace --bins --exclude shadow-rs
+	cargo build --release --workspace --bins --exclude shadow-rs
 
 build-multicall:
-	cargo build --profile $(PROFILE) --bin shadow-rs
+	cargo build --release --bin shadow-rs
 
 test:
 	cargo test --workspace
@@ -29,21 +28,21 @@ test:
 # layout matching GNU shadow-utils. Only passwd/chfn/chsh/newgrp are setuid.
 install: build
 	@for tool in $(SETUID_TOOLS); do \
-		install -Dm4755 target/$(PROFILE)/$$tool $(DESTDIR)$(BINDIR)/$$tool || exit 1; \
+		install -Dm4755 target/release/$$tool $(DESTDIR)$(BINDIR)/$$tool || exit 1; \
 	done
 	@for tool in $(ROOT_TOOLS); do \
-		install -Dm0755 target/$(PROFILE)/$$tool $(DESTDIR)$(BINDIR)/$$tool || exit 1; \
+		install -Dm0755 target/release/$$tool $(DESTDIR)$(BINDIR)/$$tool || exit 1; \
 	done
 	@echo "Installed $(words $(ALL_TOOLS)) standalone binaries to $(DESTDIR)$(BINDIR)/"
 	@echo "  setuid (4755): $(SETUID_TOOLS)"
 	@echo "  root-only (0755): $(ROOT_TOOLS)"
 
 # Opt-in install: single multicall binary with symlinks. Smaller footprint but
-# larger setuid attack surface — chmod on any setuid symlink follows through to
-# the ELF, so all tools end up running with euid=root. Intended for
+# larger setuid attack surface — the binary is installed setuid-root, so all 14
+# applets run with euid=root when invoked via symlink. Intended for
 # container/embedded use where disk savings matter and attack surface does not.
 install-multicall: build-multicall
-	install -Dm4755 target/$(PROFILE)/shadow-rs $(DESTDIR)$(BINDIR)/shadow-rs
+	install -Dm4755 target/release/shadow-rs $(DESTDIR)$(BINDIR)/shadow-rs
 	@for tool in $(ALL_TOOLS); do \
 		ln -sf shadow-rs $(DESTDIR)$(BINDIR)/$$tool; \
 	done
diff --git a/README.md b/README.md
index c16d8d2..3bef675 100644
--- a/README.md
+++ b/README.md
@@ -96,9 +96,9 @@ sudo make install PREFIX=/usr/local
 ```
 
 Alternative: single multicall binary with symlinks. Smaller footprint (~14×
-disk savings) but larger setuid attack surface, since `chmod` on a setuid
-symlink follows through to the underlying ELF — all 14 tools end up running
-with `euid=root` when invoked. Intended for container/embedded use cases.
+disk savings) but larger setuid attack surface — the binary is installed
+setuid-root, so all 14 applets run with `euid=root` when invoked via symlink.
+Intended for container/embedded use cases.
 
 ```shell
 sudo make install-multicall PREFIX=/usr/local