Hide Forgot
Previously non-root users could use 'lastlog' command. Now they get 'Permission denied'. This issue was caught by the Cockpit integration tests. There is a separate bug #1317773 for Fedora. But since RHEL Atomic Host does not track Fedora Atomic Host, I'm filing this issue separately with appropriate version numbers, etc. Version-Release number of selected component (if applicable): * 2016-03-01 01:35:21 7.2.2-2 8b2cf24b42 rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard shadow-utils-4.1.5.1-18.el7.x86_64 How reproducible: Every time Steps to Reproduce: 1. Boot RHEL Atomic Host 7.2.2-2 2. Log in as a non-root user, such as cloud-user 3. Run lastlog Actual results: $ lastlog /var/log/lastlog: Permission denied $ sudo ls -l /var/log/lastlog ----------. 1 root root 292584 Mar 15 09:05 /var/log/lastlog Expected results: $ lastlog Username Port From Latest root **Never logged in** ... $ sudo ls -l /var/log/lastlog -rw-r--r--. 1 root root 292584 Mar 15 03:49 /var/log/lastlog
For now, a non-root user hasn't a read permission on /var/log/lastlog file, if only root user can write /var/log/lastlog file, I'm not sure if it's information leakage to allow non-root to read /var/log/lastlog. [cloud-user@atomic-00 ~]$ sudo atomic host status TIMESTAMP (UTC) VERSION ID OSNAME REFSPEC * 2016-03-29 20:52:18 7.2.3 d620e84186 rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard 2016-03-11 19:31:01 7.2.3 f6f9c97816 rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard [cloud-user@atomic-00 ~]$ rpm -q shadow-utils shadow-utils-4.1.5.1-18.el7.x86_64 [cloud-user@atomic-00 ~]$ sudo ls -l /var/log/lastlog ----------. 1 root root 292292 Apr 6 09:10 /var/log/lastlog [cloud-user@atomic-00 ~]$ lastlog /var/log/lastlog: Permission denied
Why can a user read /var/log/lastlog on RHEL and Fedora but not on Atomic? Does Atomic have different requirements about sharing login information with non-root users?
(In reply to Stef Walter from comment #3) > Why can a user read /var/log/lastlog on RHEL and Fedora but not on Atomic? > Does Atomic have different requirements about sharing login information with > non-root users? I just checked a RHEL system, yes, the non-root users should have a read permison for /var/log/lastlog, but I'm not sure if it's an design for Atomic Host, anyway, I think Daniel can give a authoritative answer.
This seems like a bug. Having permissions of 000 means that even root can not read it, unless it has CAP_DAC_ADMIN. Lastlog info is not that valuable.
Colin this looks like an Atomic host bug that got lost in the noise,
I can't reproduce this with: | image | rhel-atomic-cloud-7.2-latest (936d1121-6a31-49d3-b308-a1d2c6d54c27) |
Ok lets mark this as modified then
i'll have this removed from the atomic errata. Thanks Colin
```$ rpm-ostree status State: idle; auto updates disabled Deployments: * ostree://rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard Version: 7.8.0 (2020-03-27 12:03:52) Commit: 0bbae7b8382b6228274909d26acf455738241115af3de44deac128348036f1ab ostree://rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard Version: 7.7.3 (2019-11-19 15:23:12) Commit: e0ac32316936b7e138a2f9bea407bf20124f34f519e8f7147df3edc69ca86296 $ sudo ls -l /var/log/lastlog -rw-r--r--. 1 root root 292292 Apr 29 15:17 /var/log/lastlog $ lastlog Username Port From Latest root pts/2 Mon Feb 10 14:40:23 +0000 2020 cloud-user pts/0 ovpn-66-149.rdu2 Wed Apr 29 15:17:39 +0000 2020 bin **Never logged in** daemon **Never logged in** adm **Never logged in** lp **Never logged in** sync **Never logged in** shutdown **Never logged in** halt **Never logged in** mail **Never logged in** operator **Never logged in** games **Never logged in** ftp **Never logged in** nobody **Never logged in** dbus **Never logged in** polkitd **Never logged in** etcd **Never logged in** tss **Never logged in** avahi-autoipd **Never logged in** rpc **Never logged in** sssd **Never logged in** dockerroot **Never logged in** rpcuser **Never logged in** nfsnobody **Never logged in** kube **Never logged in** sshd **Never logged in** chrony **Never logged in** systemd-network **Never logged in** gluster **Never logged in** ceph **Never logged in** ```