nixpkgs/nixos/doc/manual/release-notes
Klemens Nanni 8833983f26 nixos/users-groups: createHome: Ensure HOME permissions, fix description
configuration.nix(1) states

    users.extraUsers.<name>.createHome
        [...] If [...] the home directory already exists but is not
        owned by the user, directory owner and group will be changed to
        match the user.

i.e. ownership would change only if the user mismatched;  the code
however ignores the owner, it is sufficient to enable `createHome`:

    if ($u->{createHome}) {
        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
        chown $u->{uid}, $u->{gid}, $u->{home};
    }

Furthermore, permissions are ignored on already existing directories and
therefore may allow others to read private data eventually.

Given that createHome already acts as switch to not only create but
effectively own the home directory, manage permissions in the same
manner to ensure the intended default and cover all primary attributes.

Avoid yet another configuration option to have administrators make a
clear and simple choice between securely managing home directories
and optionally defering management to own code (taking care of custom
location, ownership, mode, extended attributes, etc.).

While here, simplify and thereby fix misleading documentation.
2020-12-16 03:40:29 +01:00
..
release-notes.xml 21.03 is Okapi 2020-09-07 14:20:35 -07:00
rl-1310.xml nixos docs: format =) 2018-05-01 19:57:09 -04:00
rl-1404.xml treewide: use https for nixos.org and hydra.nixos.org 2020-05-03 22:14:21 -07:00
rl-1412.xml Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
rl-1509.xml treewide: use https for nixos.org and hydra.nixos.org 2020-05-03 22:14:21 -07:00
rl-1603.xml treewide: use https for nixos.org and hydra.nixos.org 2020-05-03 22:14:21 -07:00
rl-1609.xml Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
rl-1703.xml Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
rl-1709.xml Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
rl-1803.xml Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
rl-1809.xml Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
rl-1903.xml docs: add -L to remaining curl install commands 2020-09-11 12:14:07 -07:00
rl-1909.xml doc/rl-1909: fix language 2019-11-15 00:32:09 +01:00
rl-2003.xml nixos/doc: convert loaOf options refs to attrsOf 2020-09-02 00:42:51 +02:00
rl-2009.xml Merge pull request #103500 from chkno/nixos-YY.MM-not-in-nixpkgs-channels 2020-11-12 23:27:27 +01:00
rl-2103.xml nixos/users-groups: createHome: Ensure HOME permissions, fix description 2020-12-16 03:40:29 +01:00