Currently the home directory permissions are set by taking the /etc/skel mode and masking it with HOME_MODE:

override_umask = 0777 & ~get_umask(&configured_umask, "HOME_MODE");
stat(skel, &sb); /* performed by nftw() */
oddjob_selinux_mkdir(newpath, sb->st_mode & ~override_umask, uid, gid);

The problem is that when HOME_MODE is more permissive than /etc/skel, the masking will not produce the desired result, e.g.

skel_mode = 0755
HOME_MODE = 0775
override_umask = 0777 & ~HOME_MODE /* 0002 */
mode = skel_mode & ~override_umask /* 0755 & 0775 = 0755 */

In order to fix the problem, mkhomedir should use 0777 & ~override_umask for the top home directory.

Version-Release number of selected component (if applicable):

• oddjob-0.34.7-1.el8.x86_64
• oddjob-mkhomedir-0.34.7-1.el8.x86_64

How reproducible:

Always

Steps to Reproduce:

1. Ensure that HOME_MODE has the required values in /etc/login.defs:

   HOME_MODE 0775

2. Ensure that /etc/skel has the default permissions

   # ls -ld /etc/skel
    drwxr-xr-x. 2 root root 76 Oct  4 09:38 /etc/skel
   

3. Create an test user, without creating the home directory

   # useradd --no-create-home test14
   

   If the user already exists, just remove the home directory

   # rm -rf ~test14
   

4. Simulate what oddjobd would do the first time the user logs in

   # echo test14 | /usr/libexec/oddjob/mkhomedir
   

   The permissions of the test14 home directory should be rwxrwxr-x but are rwxr-xr-x

   # ls -ld ~test14
   drwxr-xr-x. 2 test14 test14 76 Oct 18 09:35 /home/test14
   

5. Remove the user home directory

   # rm -rf ~test14
   

6. Ensure that PAM will use mkhomedir

   # authselect select sssd --force
   # authselect enable-feature with-mkhomedir
   # authselect enable-feature with-sudo
   # systemctl enable --now oddjobd.service
   

7. Log in as test14. The permissions of the test14 home directory should be rwxrwxr-x but are rwxr-xr-x

   # su -l test14 -c 'ls -ld $HOME'
   drwxr-xr-x. 2 test14 test14 76 Oct 18 09:43 /home/test14
   

Actual results:

The permissions of the home directory depend on the /etc/skel permissions.

Expected results:

The permissions of the home directory should be what is set in HOME_MODE.