Bug 1025065

Summary:	Authconfig does not specify args for pam_mkhomedir which results in umask=0022 and world-readable home directories.
Product:	Red Hat Enterprise Linux 6	Reporter:	John Conroy <jconroy>
Component:	authconfig	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED ERRATA	QA Contact:	David Spurek <dspurek>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.6	CC:	dspurek, ebenes, ian, tmraz
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	authconfig-6.1.12-14.el6	Doc Type:	Bug Fix
Doc Text:	Cause: The default umask when creating home directories with pam_mkhomedir is 0022. Consequence: The home directories created with pam_mkhomedir were world readable. Fix: Use umask=0077 option with pam_mkhomedir by default. Result: The home directories newly created by pam_mkhomedir are no longer world readable.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-14 07:44:55 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description John Conroy 2013-10-30 22:40:33 UTC

Description of problem:
By default, authconfig does not specify args for pam_mkhomedir (or pam_oddjob_mkhomedir) which results in umask=0022 and world-readable home directories.

Version-Release number of selected component (if applicable):
authconfig-6.1.12-13.el6

How reproducible:
Always

Steps to Reproduce:
1.  authconfig --enablemkhomedir --updateall
2.  Check the PAM config files in /etc/pam.d
3.

Actual results:
No arguments are supplied, resulting in a UMASK of 0022 for home directories making them world-readable by default.

Expected results:
Something along the lines of "skel=/etc/skel/ umask=0077", though skel is supposed to be defaulted to /etc/skel and should be unecessary.

Additional info:
Should probably update authinfo.py to supply a more sane default UMASK to the pam_mkhomedir plugin or allow the args to be specified on the command line and saved in /etc/sysconfig/authconfig...or both.  :)

self.mkhomedirArgs = "skel=/etc/skel/ umask=0077"

Comment 3 Tomas Mraz 2014-03-26 09:51:29 UTC

We would just add umask=0077 to the initial arguments of pam_mkhomedir/pam_oddjob_mkhomedir if enabled with --enablemkhomedir.

Comment 7 errata-xmlrpc 2014-10-14 07:44:55 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1558.html