RHBA-2015:0446 - Bug Fix Advisory

Topic

Updated oddjob packages that fix two bugs and add one enhancement are now
available for Red Hat Enterprise Linux 7.

Description

The oddjob service runs specified privileged tasks for unprivileged client
applications which communicate with it through the system message bus.

This update fixes the following bugs:

• Prior to this update, the mkhomedir helper process for oddjob incorrectly

interpreted results returned by the getpwnam_r() function. The function then
sometimes failed to look up the home directory of a user, including situations
when the system stored the user password information in the /etc/passwd file.
Consequently, mkhomedir ignored requests to create a home directory for every
affected user. This update corrects the logic error, and mkhomedir now works as
expected in the described situation. (BZ#1098616)

• Previously, the default configuration for the mkhomedir helper process for

oddjob specified that the umask value of 002 was to be used when populating the
home directory of a user. Consequently, the system ignored any UMASK setting
defined in the /etc/login.defs configuration file and always used the default
configuration instead. The mkhomedir default configuration has been modified to
no longer specify that the default umask value is passed to mkhomedir when the
helper process is run. As a result, mkhomedir now uses the value specified in
/etc/login.defs. (BZ#1123860)

In addition, this update adds the following enhancement:

• Previously, the pam_oddjob_mkhomedir(8) man page did not mention that

pam_oddjob_mkhomedir module does not accept any options. As a consequence, the
user could assume that pam_oddjob_mkhomedir accepted the same options as the
similarly-named pam_mkhomedir module documented in the pam_mkhomedir(8) man
page, including the umask option. The pam_oddjob_mkhomedir(8) man page has been
updated with the information that pam_oddjob_mkhomedir does not accept any
options. (BZ#1108398)

Users of oddjob are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1098616 - oddjob-mkhomedir fails mkdir: cannot create directory Permission denied
• BZ - 1123860 - enablemkhomedir uses wrong security mask

CVEs

(none)

References

(none)