Bug 1886362

Summary:	oddjob-mkhomedir - homedir has a wrong permissions
Product:	Red Hat Enterprise Linux 8	Reporter:	Filip Dvorak <fdvorak>
Component:	oddjob	Assignee:	Alexander Bokovoy <abokovoy>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	8.3	CC:	abokovoy, ksiddiqu, lmiksik, rcritten
Target Milestone:	rc	Keywords:	Regression
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	oddjob-0.34.5-3.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1886433 (view as bug list)		Environment:
Last Closed:	2020-11-04 03:01:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1886433

Description Filip Dvorak 2020-10-08 09:39:59 UTC

Description of problem:
oddjob-mkhomedir creates a directory with bad permissions by default. The created home directories are readable by group and other. 

Version-Release number of selected component (if applicable):
RHEL-8.3
oddjob-0.34.5-2.el8.x86_64, 
oddjob-mkhomedir-0.34.5-2.el8.x86_64

Steps to Reproduce:
1. useradd -M alice
2. authselect select sssd with-mkhomedir

# grep oddjob /etc/pam.d/system-auth 
session     optional                   pam_oddjob_mkhomedir.so umask=0077

3. su -c pwd - alice

Actual results:
ls -alZ /home/
drwxr-xr-x.  3 root  root  system_u:object_r:home_root_t:s0          19 Oct  8 05:26 .
dr-xr-xr-x. 17 root  root  system_u:object_r:root_t:s0              224 Sep 30 01:06 ..
drwxr-xr-x.  2 alice alice unconfined_u:object_r:user_home_dir_t:s0  62 Oct  8 05:26 alice

Expected results:
drwx------.  2 alice alice unconfined_u:object_r:user_home_dir_t:s0  62 Oct  8 05:26 alice


Additional info:
it works corectly with RHEL-8.3.0-20200701.2.

Comment 1 Alexander Bokovoy 2020-10-08 10:13:48 UTC

Filip, oddjob does not own PAM configuration.

The configuration for mkhomedir is part of authselect SSSD profile.

# fgrep mkhomedir /usr/share/authselect/default/sssd/system-auth
session     optional                                     pam_oddjob_mkhomedir.so umask=0077                    {include if "with-mkhomedir"}

However, pam_oddjob_mkhomedir.so does not take any options, so specifying umask there is not going to affect actual umask used, as explained in the module's manual page:

       The location of the skeleton directory and the default umask are determined by the configuration for the corresponding service in oddjobd-mkhomedir.conf, so they can not be specified as arguments to this module.


This is actually not full story because mkhomedir helper does not read any umask parameters from oddjobd-mkhomedir.conf but instead accepts command line options (which are unused in this workflow) or reads default umask value from /etc/login.defs.

/etc/login.defs has 

UMASK 022

by default. This file is owned by shadow-utils and it recently changed default UMASK value from 0077 to 022:
http://pkgs.devel.redhat.com/cgit/rpms/shadow-utils/commit/?h=rhel-8.3.0&id=345e1be7cd68e2e6c541692d2e3ce8e23931a0f8

This explains your results.

The change is due to https://bugzilla.redhat.com/show_bug.cgi?id=1777718 which requested UMASK to revert back to (less secure) 022 to be compatible with RHEL 7.

Comment 2 Alexander Bokovoy 2020-10-08 10:18:05 UTC

Apparently, shadow-utils changed meaning of UMASK and introduced HOME_MODE instead for home directories. However, nobody informed oddjob that HOME_MODE needs to be read.

This means current configuration is broken.

Comment 6 Alexander Bokovoy 2020-10-08 10:53:10 UTC

Upstream pull request: https://pagure.io/oddjob/pull-request/12

Comment 7 Alexander Bokovoy 2020-10-08 11:03:49 UTC

Unrelated to this bug, I added https://github.com/authselect/authselect/issues/223 to authselect as it erroneously adds umask=.. line to PAM configuration. As explained in the man page for pam_oddjob_mkhomedir.so, it does not accept any option.

Comment 8 Alexander Bokovoy 2020-10-08 12:35:34 UTC

Merged upstream.

Comment 17 errata-xmlrpc 2020-11-04 03:01:07 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: oddjob security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4687