Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create /etc/{,g}shadow via tmpfiles #1045

Open
cgwalters opened this issue Oct 10, 2017 · 0 comments
Open

Create /etc/{,g}shadow via tmpfiles #1045

cgwalters opened this issue Oct 10, 2017 · 0 comments
Labels
kind/enhancement

Comments

@cgwalters
Copy link
Member

I propose we do this rather than having /usr/etc/shadow in the tree.

$ cat /usr/lib/tmpfiles.d/rpm-ostree-shadow.conf
f /etc/shadow 0000 root root -
f /etc/gshadow 0000 root root -

The user-unreadable permissions for /etc/shadow have been a perennial source of bugs. Today it's breaking my prototype ostree2oci script, since libostree can't read the file as non-root.

I'm going to do some playing with this. We should ping the PAM/shadow maintainer about this too.
@cgwalters cgwalters mentioned this issue Oct 10, 2017
Closed
cgwalters added a commit to cgwalters/rpm-ostree that referenced this issue Oct 10, 2017
@cgwalters
ex-container: Make /usr/etc/{,g}shadow user-readable
5ea89cb 
For the `ex container` case, there's no security issues here; one shouldn't be
doing user management in these roots at all.

This is for work on exporting `ex container` roots to OCI as non-root. Without
this fix, libostree just tries to `openat()` the object for export to tar, and
fails.

See also coreos#1045
rh-atomic-bot pushed a commit that referenced this issue Oct 10, 2017
@cgwalters @rh-atomic-bot
ex-container: Make /usr/etc/{,g}shadow user-readable
575b468 
For the `ex container` case, there's no security issues here; one shouldn't be
doing user management in these roots at all.

This is for work on exporting `ex container` roots to OCI as non-root. Without
this fix, libostree just tries to `openat()` the object for export to tar, and
fails.

See also #1045

Closes: #1046
Approved by: jlebon
rh-atomic-bot pushed a commit that referenced this issue Oct 10, 2017
@cgwalters @rh-atomic-bot
ex-container: Make /usr/etc/{,g}shadow user-readable
334f0b8 
For the `ex container` case, there's no security issues here; one shouldn't be
doing user management in these roots at all.

This is for work on exporting `ex container` roots to OCI as non-root. Without
this fix, libostree just tries to `openat()` the object for export to tar, and
fails.

See also #1045

Closes: #1046
Approved by: jlebon
@cgwalters cgwalters mentioned this issue Apr 30, 2018
Open
@cgwalters cgwalters mentioned this issue Oct 11, 2018
Merged
@champtar champtar mentioned this issue May 9, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@cgwalters