Bug 190154 - pam_mkhomedir incorrectly labels newly-created home
pam_mkhomedir incorrectly labels newly-created home
Product: Fedora
Classification: Fedora
Component: pam (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tomas Mraz
Depends On:
  Show dependency treegraph
Reported: 2006-04-28 04:38 EDT by Bernard Bou
Modified: 2007-11-30 17:11 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-08-07 11:25:57 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Bernard Bou 2006-04-28 04:38:23 EDT
Description of problem:
pam_mkhomedir incorrectly labels user home created on the fly as home_root_t.
Files that get copied in the process from /etc/skel such as .bash_profile are
also labeled as home_root_t

Version-Release number of selected component (if applicable):
selinux-2.2.34-3.fc5 (and also lower versions ?)

How reproducible:

Steps to Reproduce:
1.put pam_mkhomedir in /etc/pam.d/system-auth
2.open session as user with no home created
3.ls -Z
Actual results:
user home is labeled system_u:object_r:home_root_t
files copied from skel are also labeled system_u:object_r:home_root_t

Expected results:
user home should be labeled system_u:object_r:user_home_dir_t
files copied from skel should be labeled system_u:object_r:user_home_t

Additional info:
# session block in /etc/pam.d/system-auth
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session required pam_limits.so 
session required pam_unix.so 
Comment 1 Daniel Walsh 2006-05-02 14:57:28 EDT
This is a problem with pam.  The pam module would need create the homedir with
the correct context, problem is that every application that calls pam would then
need the privs to create the files/directories with the correct context.  

A better solution would be to use oddjob from fedora-extras

try pam_oddjob_mkhomedir.so

Which basically does the same type of thing and actually works.

yum install oddjob

Comment 2 Tomas Mraz 2006-08-07 11:25:57 EDT
This is impossible to fix with the current pam_mkhomedir module. Use oddjob as
recommended by Dan Walsh.

Note You need to log in before you can comment on or make changes to this bug.