Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
From oddjob-mkhomedir >= 0.34.5, fix for CVE-2020-10737 prevents symlink racing by 
creating home directory as root, then chown back to the users after the home directory is done.

However, by default, NFS server use root squash, that means root from NFS client is treat as nobody in NFS server.
Thus in NFS server, home directories cannot be chowned to user as nobody, 
thus the owner of the newly create home directory in NFS client is root, preventing user access. 
 
Version-Release number of selected component (if applicable):
oddjob-mkhomedir >= 0.34.5

How reproducible:
Always


Steps to Reproduce:
1. Setup pam_oddjob_mkhomedir.so in PAM
2. Mount NFS share as /home
3. useradd exampleuser


Actual results:
/home/exampleuser is owned by root

Expected results:
/home/exampleuser should be owned by exampleuser

Additional info:
Workaround: Create home directory in exampleuser in NFS server before NFS client mount it.

oddjob-mkhomedir was never supposed to work with NFS root squash configuration. If you are using NFS-based home directories, they should be pre-created on the NFS server, not on the client.

What is described in 'steps to reproduce' is an unsupported use of oddjob-mkhomedir.

I am closing this as a not a bug.

A workaround is using pam_exec to create a home directory.

The detail is available in 

https://access.redhat.com/solutions/6732801 - HowTo: create home directory with pam_exec

I submitted an upstream PR to add old behavior as a non-default one: https://pagure.io/oddjob/pull-request/14

PR 14 merged, https://pagure.io/oddjob/pull-request/14

Verified using nightly build.

ipa-server-4.9.10-5.module+el8.7.0+16195+c459c321.x86_64
oddjob-0.34.7-2.el8.x86_64

test_integration/test_authselect.py::http://idm-artifacts.usersys.redhat.com/sumenon/trigger//6688/test-suite/report.html.gz
test_integration/test_trust.py::http://idm-artifacts.usersys.redhat.com/sumenon/trigger//6690/test-suite/report.html.gz

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (oddjob bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7652