Merge pull request #133006 from nberlee/pam-mk-homedir-umask
nixos/pam: pam_mkhomedir umask to 0077
commitecb6c3515fa67049de9e4c2534c151f4538773c2
authorAaron Andersen <aaron@fosslib.net>
dateSat 6 Nov 2021, 12:17 (5 years ago)
parenta97d32d90bac67
nixos/doc/manual/from_md/release-notes/rl-2111.section.xml+8
@@ -1851,6 +1851,14 @@ Superuser created successfully.
18511851 </listitem>
18521852 </itemizedlist>
18531853 </listitem>
1854+ <listitem>
1855+ <para>
1856+ <literal>security.pam.services.<name>.makeHomeDir</literal>
1857+ now uses <literal>umask=0077</literal> instead of
1858+ <literal>umask=0022</literal> when creating the home
1859+ directory.
1860+ </para>
1861+ </listitem>
18541862 </itemizedlist>
18551863 </section>
18561864</section>
nixos/doc/manual/release-notes/rl-2111.section.md+2
@@ -514,3 +514,5 @@ In addition to numerous new and upgraded packages, this release has the followin
514514 - The `services.unifi.dataDir` option is removed and the data is now always located under `/var/lib/unifi/data`. This is done to make better use of systemd state direcotiry and thus making the service restart more reliable.
515515 - The unifi logs can now be found under: `/var/log/unifi` instead of `/var/lib/unifi/logs`.
516516 - The unifi run directory can now be found under: `/run/unifi` instead of `/var/lib/unifi/run`.
517+
518+- `security.pam.services.<name>.makeHomeDir` now uses `umask=0077` instead of `umask=0022` when creating the home directory.
nixos/modules/security/pam.nix+1−1
@@ -483,7 +483,7 @@ let
483483 if config.boot.isContainer then "optional" else "required"
484484 } pam_loginuid.so"}
485485 ${optionalString cfg.makeHomeDir
486− "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0022"}
486+ "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0077"}
487487 ${optionalString cfg.updateWtmp
488488 "session required ${pkgs.pam}/lib/security/pam_lastlog.so silent"}
489489 ${optionalString config.security.pam.enableEcryptfs