oddjob_mkhomedir or mkhomedir

Latest response

It appears that there has been a conscious decision made within Red Hat to move away from pam_mkhomedir in favour of pam_oddjob_mkhomedir, but I haven't yet been able to find a written reference to this.

I came to this by identifying a bug in a configuration with pam_mkhomedir SELinux types being incorrectly set on newly created home directories (home_root_t not user_home_dir_t). It would appear several others have found this bug, and it has been filed (in one instance) at the following URL.

https://bugzilla.redhat.com/show_bug.cgi?id=903880

I was quite surprised by the response "Please use oddjob_mkhomedir" and the closure status "CLOSED NOTABUG" to what appears to be a valid bug report. Is there a reason the SELinux policy for pam_mkhomedir isn't being fixed? pam_mkhomedir is shipped as part of the PAM package, so I would assume it is supported by Red Hat and should be fixed? Is there another issue that would lead to pam_mkhomedir being deprecated that someone from Red Hat can explain?

Interestingly the same bug was raised here, and apparently resolved and closed as Errata:
https://bugzilla.redhat.com/show_bug.cgi?id=863132

Unfortunately, to provide the oddjob_mkhomedir capability you need two additional services running
oddjobd - to execute the jobs
messagebus - to message the oddjob service

So am I right in thinking that this requires two extra services running and three extra packages installed to work around an SELinux bug in a module that ships with the default PAM configuration?

Responses