• Comments
  • oddjob_mkhomedir or mkhomedir

    Posted on

    It appears that there has been a conscious decision made within Red Hat to move away from pam_mkhomedir in favour of pam_oddjob_mkhomedir, but I haven't yet been able to find a written reference to this.

    I came to this by identifying a bug in a configuration with pam_mkhomedir SELinux types being incorrectly set on newly created home directories (home_root_t not user_home_dir_t). It would appear several others have found this bug, and it has been filed (in one instance) at the following URL.

    https://bugzilla.redhat.com/show_bug.cgi?id=903880

    I was quite surprised by the response "Please use oddjob_mkhomedir" and the closure status "CLOSED NOTABUG" to what appears to be a valid bug report. Is there a reason the SELinux policy for pam_mkhomedir isn't being fixed? pam_mkhomedir is shipped as part of the PAM package, so I would assume it is supported by Red Hat and should be fixed? Is there another issue that would lead to pam_mkhomedir being deprecated that someone from Red Hat can explain?

    Interestingly the same bug was raised here, and apparently resolved and closed as Errata:
    https://bugzilla.redhat.com/show_bug.cgi?id=863132

    Unfortunately, to provide the oddjob_mkhomedir capability you need two additional services running
    oddjobd - to execute the jobs
    messagebus - to message the oddjob service

    So am I right in thinking that this requires two extra services running and three extra packages installed to work around an SELinux bug in a module that ships with the default PAM configuration?

    by

    points

    Responses

    Red Hat
    © 2025 Red Hat, Inc.