JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nixos: Set home directory parent tree permissions to 0755

Browse Source 
When the user's home directory is created using `createHome` e.g.

```
users.users.alice = {
    home = "/users/alice";
    createHome = true;
};
```

The `/users` directory was created with the same permissions as `/users/alice`, `0700` by default.

The parent directory `/users` permissions results in `createHome` creating a home directory that is inaccessible to the user:

```
$ su alice
$ cd /user/alice
cd: permission denied: /users/alice
```

The underlying cause is `make_path($u->{home}, { mode => oct($u->{homeMode}) })` which sets, in the example above`, `/users` to `0700`. Instead it should be `0755` like other system directories `/var`, `/dev`, etc.
This commit is contained in:
Tom Butler 2024-07-09 22:09:09 +01:00 committed by GitHub
parent 0a19ea8fb5
commit e7e8ad1e35
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/config/update-users-groups.pl
View File

@ -234,7 +234,7 @@ foreach my $u (@{$spec->{users}}) {
# Ensure home directory incl. ownership and permissions.
if ($u->{createHome} and !$is_dry) {
make_path($u->{home}, { mode => oct($u->{homeMode}) }) if ! -e $u->{home};
make_path($u->{home}, { mode => 0755 }) if ! -e $u->{home};
chown $u->{uid}, $u->{gid}, $u->{home};
chmod oct($u->{homeMode}), $u->{home};
}

8
nixos/tests/user-home-mode.nix
View File

@ -12,6 +12,12 @@ import ./make-test-python.nix ({ lib, ... }: {
isNormalUser = true;
homeMode = "750";
};
users.users.carol = {
initialPassword = "pass3";
isNormalUser = true;
createHome = true;
home = "/users/carol";
};
};
testScript = ''
@ -23,5 +29,7 @@ import ./make-test-python.nix ({ lib, ... }: {
machine.send_chars("pass1\n")
machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
machine.succeed('[ "$(stat -c %a /users)" == "755" ]')
machine.succeed('[ "$(stat -c %a /users/carol)" == "700" ]')
'';
})