security-misc/usr/share/pam-configs/mkhomedir-security-misc

Name: Create home directory on login (by package security-misc)
Default: yes
Priority: 100
Session-Type: Additional
Session-Interactive-Only: yes
Session:
	optional	pam_mkhomedir.so umask=027
description 2019-08-11 17:31:29 +07:00			`Name: Create home directory on login (by package security-misc)`
enable usr/share/pam-configs/mkhomedir-security-misc by default 2019-08-11 17:30:51 +07:00			`Default: yes`
change priories so "pam_umask.so usergroups umask=006" runs before pam_exec.so /usr/lib/security-misc/permission-lockdown 2019-08-14 16:31:58 +07:00			`Priority: 100`
add usr/share/pam-configs/mkhomedir-security-misc based on /usr/share/pam-configs/mkhomedir 2019-08-11 17:28:55 +07:00			`Session-Type: Additional`
			`Session-Interactive-Only: yes`
			`Session:`
security-misc `/usr/share/pam-configs/permission-lockdown-security-misc` is no longer required, removed. Thereby fix apparmor issue. > Dec 08 09:47:50 host audit[3232]: AVC apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=3232 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 > Dec 08 09:47:50 host sudo[3232]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied It is no longer required, because... existing linux user accounts: * Get permission lock down because security-misc `debian/security-misc.postinst` calls `/usr/lib/security-misc/permission-lockdown`. new linux user accounts (created at first boot): * security-misc `/usr/share/pam-configs/mkhomedir-security-misc` pam mkhomedir sets secure permissions using `umask=027`. 2019-12-08 17:21:35 +07:00			`optional pam_mkhomedir.so umask=027`