On 3/9/22 23:47, Marc Haber wrote:
On Wed, 9 Mar 2022 14:35:52 -0600, Richard Laager <rlaager@debian.org> wrote:
If the admin can change the default DIR_MODE that applies to system user home directories, then any postinst script doing `adduser --system` needs to also explicitly chmod its home directory if it needs anything more permissive than 700 or more restrictive than 755. This is true today and remains true whether or not the default DIR_MODE is changed.
Anything that NEEDS to be written in postinst scripts is bad. I'd rather implement a SYSTEM_DIR_MODE setting that applies to directories created during creation of a --system user. Would that help with the issue?
Yes that would _help_, as that would allow the system administrator to change DIR_MODE without changing SYSTEM_DIR_MODE.
However, if SYSTEM_DIR_MODE is configurable, you end up with the same problem: unless a given package can work with _any_ reasonable mode (700 to 755), it must explicitly set its own mode. Otherwise, if the administrator sets SYSTEM_DIR_MODE to something too restrictive (scenario A below), some packages will break; if they set it too permissive, some packages will become insecure (scenario B).
Having a hardcoded default for system users would at least allow packages certainty, and those that were happy with the default would not need to chmod.
Further, my assumption is that there are two different scenarios:A) The system user's home directory needs to be open. For example, if there is a socket in there that needs to be world-writable, which I think you were talking about.
B) The system user's home directory needs to be private. For example, there is sensitive data in there. (Another, perhaps better, answer is that the _files_ should have restricted permissions.)
_If_ it is the case that both of these scenarios exist, then no single value (default or hardcoded) can satisfy both. So the default should either be the most common mode, or the most restrictive (reasonable) mode.
This should probably be my last email on this subtopic. Hopefully I've conveyed my points for your consideration. I don't feel that I'm an expert on the use of system users in Debian.
-- Richard
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature