Re: [gentoo-dev] RFC: Setting default HOME_MODE in /etc/login.defs

[Sam James <sam@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 2014 bytes --]


Daniel Simionato <daniel.simionato@gmail.com> writes:

> Hello,
>  I'd like to start a discussion regarding setting HOME_MODE by default in the /etc/login.defs file (owned by
> sys-apps/shadow package).
>
> Upstream keeps HOME_MODE commented:
> https://github.com/shadow-maint/shadow/blob/3e59e9613ec40c51c19c7bb5c28468e33a4529d5/etc/login.defs#L207
>
> HOME_MODE affects only useradd and newuser commands: if HOME_MODE is set, they will use the specified permission when
> creating a user home directory, otherwise the default UMASK will be used.
> Since the default umask is 022, keeping HOME_MODE unset will result in home readable home directories created by useradd,
> which goes against security best practices.
>
> The proposal is to set HOME_MODE to 0700, or at least 0750: RedHat and RH based distros, OpenSuse, ArchLinux all set it
> to 0700, Ubuntu has it at 0750. Debian and Gentoo are two exceptions, keeping the upstream value of HOME_MODE (although
> login.defs is changed in other ways).
>
> I previously made a PR on github where you can find more details (https://github.com/gentoo/gentoo/pull/35231), but as
> pointed in the comments this probably warrants some discussion beforehand.
>
> I can understand the argument against the change, which is keeping in sync with upstream and don't risk changing the
> historic default behaviour of tools some users might rely upon.
>
> I do believe though there's merit in providing safer and secure defaults, so I would like HOME_MODE to have a safe
> default value for Gentoo and Gentoo based distros.

I'm in favour, although I'd be curious as to why upstream shadow don't
just set it. It would be interesting to see if the discussion already
happened there at some point (surely it has?) and find out their
reasoning. (But that's not a blocker for proceeding.)

I want to hear more opinions first though. Thanks for raising this,
it's been in the back of my head.

>
> Have a nice day,
>  Daniel 

best,
sam

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 377 bytes --]