[Bug 1957024] Re: pam-mkhomedir does not honor private home directories

[Andrew Lowther]

Here is a demonstration as requested in Discourse.  These steps were run
on a stock image of Ubuntu Impish taken from https://cloud-
images.ubuntu.com/impish/current/.

Showing the inconsistent behavior of the default settings if the goal is
private home directories.  Both adduser and useradd create a home
directory that is private but pam_mkhomedir.so does not.

# enable pam_mkhomedir.so configuration
pam-auth-update --enable mkhomedir
# create a user with adduser that creates the home directory
adduser --disabled-password --gecos adduser homemadebyadduser
# create a user with useradd that creates the home directory
useradd --create-home homemadebyuseradd
# create a user with useradd that does *not* create the home directory so that pam_mkhomedir.so can create it
useradd --no-create-home homemadebymkhomedir
# trigger pam_mkhomedir.so to create the home directory
su - homemadebymkhomedir -c exit

The result is inconsistent permissions on the home directories.
root at ubuntu:~# ls -al /home
total 24
drwxr-xr-x  6 root                root                4096 Jan 11 03:27 .
drwxr-xr-x 19 root                root                4096 Jan 11 03:13 ..
drwxr-x---  2 homemadebyadduser   homemadebyadduser   4096 Jan 11 03:20 homemadebyadduser
drwxr-xr-x  2 homemadebymkhomedir homemadebymkhomedir 4096 Jan 11 03:27 homemadebymkhomedir
drwxr-x---  2 homemadebyuseradd   homemadebyuseradd   4096 Jan 11 03:23 homemadebyuseradd
drwxr-x---  4 ubuntu              ubuntu              4096 Jan 11 03:15 ubuntu


Configuring pam_mkhomedir.so to be consistent with the other tools.

# update pam_mkhomedir.so configuration
sed -i -e "s/pam_mkhomedir.so$/pam_mkhomedir.so umask=0027/" /usr/share/pam-configs/mkhomedir
# enable mkhomedir again
pam-auth-update --enable mkhomedir
# create a user with useradd that does *not* create the home directory so that pam_mkhomedir.so can create it
useradd --no-create-home homemadebymkhomedirpatch
# trigger pam_mkhomedir.so to create the home directory
su - homemadebymkhomedirpatch -c exit

The result is the permissions are consistent with the other tools.
root at ubuntu:~# ls -l /home/
total 20
drwxr-x--- 2 homemadebyadduser        homemadebyadduser        4096 Jan 11 03:20 homemadebyadduser
drwxr-xr-x 2 homemadebymkhomedir      homemadebymkhomedir      4096 Jan 11 03:27 homemadebymkhomedir
drwxr-x--- 2 homemadebymkhomedirpatch homemadebymkhomedirpatch 4096 Jan 11 03:36 homemadebymkhomedirpatch
drwxr-x--- 2 homemadebyuseradd        homemadebyuseradd        4096 Jan 11 03:23 homemadebyuseradd
drwxr-x--- 4 ubuntu                   ubuntu                   4096 Jan 11 03:15 ubuntu

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to pam in Ubuntu.
https://bugs.launchpad.net/bugs/1957024

Title:
  pam-mkhomedir does not honor private home directories

Status in pam package in Ubuntu:
  New

Bug description:
  As reported in https://discourse.ubuntu.com/t/private-home-
  directories-for-ubuntu-21-04-onwards/19533/13:

  A common situation is to have a central set of users (e.g. in LDAP)
  and use pam_mkhomedir.so to create the home directory when the user
  first logs in.

  These changes do not cover this situation. The default configuration
  of pam_mkhomedir.so will result in a home directory created with 0755
  permissions.

  To make pam_mkhomedir.so create a home directory by default with
  permissions consistent with the other tools then a umask argument can
  be added to the pam_mkhomedir.so module in the file /usr/share/pam-
  configs/mkhomedir. I believe this would have to be done before
  enabling the module. The file is part of the libpam-modules package.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pam/+bug/1957024/+subscriptions