IntenseWebs/distrobox
3
0
Fork 0
mirror of https://github.com/89luca89/distrobox.git synced 2026-08-17 16:34:42 -05:00
Code Issues Packages Projects Releases Wiki Activity

init: chmod shadow files to 0400 for container storage compatibility (#2020)

Browse Source 
On container storage drivers where CAP_DAC_OVERRIDE is not effective
(e.g. fuse-overlayfs in rootless mode, or VMs like Docker Desktop /
Colima on macOS), root cannot read files with mode 000 despite having
the capability in its effective set. This causes pam_unix.so account
management to fail with "Authentication service cannot retrieve
authentication info" when calling getspnam(), because glibc's NSS
files backend cannot open /etc/shadow.

Fedora and Arch ship /etc/shadow and /etc/gshadow as mode 000, relying
on CAP_DAC_OVERRIDE to grant root access. Set them to 0400 (owner-read)
after password setup so that standard POSIX owner checks suffice.

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
This commit is contained in:
Luca Di Maio
2026-03-19 14:42:55 +01:00
committed by GitHub
parent 68990f5486
commit c6cc6a3d5b
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
distrobox-init
+7
View File
@@ -2621,6 +2621,13 @@ fi
# Now we're done
touch /etc/passwd.done
# Ensure shadow files are readable by root without relying on CAP_DAC_OVERRIDE,
# which may not be effective on all container storage drivers (e.g. fuse-overlayfs
# in rootless mode, or VMs like Docker Desktop / Colima on macOS).
# Fedora/Arch ship these as mode 000, expecting the capability to bypass DAC.
chmod 0400 /etc/shadow 2> /dev/null || :
chmod 0400 /etc/gshadow 2> /dev/null || :
###############################################################################
###############################################################################