Re: [gentoo-dev] RFC: Setting default HOME_MODE in /etc/login.defs

["Arsen Arsenović" <arsen@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1719 bytes --]


Daniel Simionato <daniel.simionato@gmail.com> writes:

> Hello,
>  I'd like to start a discussion regarding setting HOME_MODE by default in
> the /etc/login.defs file (owned by sys-apps/shadow package).
>
> Upstream keeps HOME_MODE commented:
> https://github.com/shadow-maint/shadow/blob/3e59e9613ec40c51c19c7bb5c28468e33a4529d5/etc/login.defs#L207
>
> HOME_MODE affects only useradd and newuser commands: if HOME_MODE is set,
> they will use the specified permission when creating a user home directory,
> otherwise the default UMASK will be used.
> Since the default umask is 022, keeping HOME_MODE unset will result in home
> readable home directories created by useradd, which goes against security
> best practices.
>
> The proposal is to set HOME_MODE to 0700, or at least 0750: RedHat and RH
> based distros, OpenSuse, ArchLinux all set it to 0700, Ubuntu has it at
> 0750. Debian and Gentoo are two exceptions, keeping the upstream value of
> HOME_MODE (although login.defs is changed in other ways).
>
> I previously made a PR on github where you can find more details (
> https://github.com/gentoo/gentoo/pull/35231), but as pointed in the
> comments this probably warrants some discussion beforehand.
>
> I can understand the argument against the change, which is keeping in sync
> with upstream and don't risk changing the historic default behaviour of
> tools some users might rely upon.
>
> I do believe though there's merit in providing safer and secure defaults,
> so I would like HOME_MODE to have a safe default value for Gentoo and
> Gentoo based distros.
>
> Have a nice day,
>  Daniel

+1 for 0700.  I also like the umask suggestions.
-- 
Arsen Arsenović

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 381 bytes --]