{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/5481","repository_url":"https://api.github.com/repos/ansible/ansible-modules-core","labels_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/5481/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/5481/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/5481/events","html_url":"https://github.com/ansible/ansible-modules-core/issues/5481","id":187165603,"number":5481,"title":"User module creates home directory for existing user with incorrect SELinux types and permissions.","user":{"login":"chriskarel","id":11828048,"avatar_url":"https://avatars.githubusercontent.com/u/11828048?v=3","gravatar_id":"","url":"https://api.github.com/users/chriskarel","html_url":"https://github.com/chriskarel","followers_url":"https://api.github.com/users/chriskarel/followers","following_url":"https://api.github.com/users/chriskarel/following{/other_user}","gists_url":"https://api.github.com/users/chriskarel/gists{/gist_id}","starred_url":"https://api.github.com/users/chriskarel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chriskarel/subscriptions","organizations_url":"https://api.github.com/users/chriskarel/orgs","repos_url":"https://api.github.com/users/chriskarel/repos","events_url":"https://api.github.com/users/chriskarel/events{/privacy}","received_events_url":"https://api.github.com/users/chriskarel/received_events","type":"User","site_admin":false},"labels":[{"id":437720344,"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/affects_2.1","name":"affects_2.1","color":"5319e7","default":false},{"id":132571937,"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/bug_report","name":"bug_report","color":"fbca04","default":false},{"id":414073372,"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/waiting_on_maintainer","name":"waiting_on_maintainer","color":"d93f0b","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-03T19:21:59Z","updated_at":"2017-02-07T10:12:04Z","closed_at":null,"body":"<!--- Verify first that your issue/request is not already reported in GitHub -->\r\n\r\n##### ISSUE TYPE\r\n<!--- Pick one below and delete the rest: -->\r\n - Bug Report\r\n\r\n\r\n##### COMPONENT NAME\r\nUser module\r\n\r\n##### ANSIBLE VERSION\r\n<!--- Paste verbatim output from “ansible --version” between quotes below -->\r\n```\r\n# ansible --version\r\nansible 2.1.2.0\r\n  config file = /etc/ansible/ansible.cfg\r\n  configured module search path = Default w/o overrides\r\n\r\n```\r\n\r\n##### CONFIGURATION\r\n<!---\r\nMention any settings you have changed/added/removed in ansible.cfg\r\n(or using the ANSIBLE_* environment variables).\r\n-->\r\nNothing unusual\r\n\r\n##### OS / ENVIRONMENT\r\nOEL/RHEL 7\r\n\r\n##### SUMMARY\r\nUsing the user module on an existing user, but changing their home directory, results in the new home directory created with improper filesystem permissions and SELinux types.\r\n\r\n##### STEPS TO REPRODUCE\r\nHave an existing user, with an existing home directory setting.  Then use the Ansible user module to change that home directory.  The new directory will be created, but with the same permissions and SELinux values as the parent directory, rather than the usual home settings.\r\n\r\n<!--- Paste example playbooks or commands between quotes below -->\r\n```\r\n# cat bugtest.yaml \r\n\n---\r\n- name: Showcase bug\r\n  hosts: all\r\n  tasks:\r\n    - name: Create system accounts\r\n      user:\r\n        name={{item}}\r\n        home=/home/{{item}}\r\n        state=present\r\n      with_items:\r\n         - user_existing\r\n         - user_not_existing\r\n\r\n\r\n# useradd -d /home/userold user_existing\r\n# ls -lZd /home/user*\r\ndrwx------. user_existing user_existing unconfined_u:object_r:user_home_dir_t:s0 /home/userold\r\n\r\n<run the above playbook for this host>\r\n\r\n# ls -lZd /home/user*\r\ndrwxr-xr-x. user_existing     user_existing     unconfined_u:object_r:home_root_t:s0 /home/user_existing\r\ndrwx------. user_not_existing user_not_existing unconfined_u:object_r:user_home_dir_t:s0 /home/user_not_existing\r\ndrwx------. user_existing     user_existing     unconfined_u:object_r:user_home_dir_t:s0 /home/userold\r\n\r\n```\r\n\r\n\r\n<!--- You can also paste gist.github.com links for larger files -->\r\n\r\n##### EXPECTED RESULTS\r\n<!--- What did you expect to happen when running the steps above? -->\r\nI would expect the new home directory that is created for an existing user would have similar permissions and SELinux values as a new home directory created for a brand new user.  (eg: permissions of 0700, type of user_home_dir_t)\r\nThis also impacts the .ssh directory, if generate_ssh_key is true.  I would expect the .ssh directory to have ssh_home_t type, but it does not.\r\n\r\n##### ACTUAL RESULTS\r\n<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->\r\nThe new home directory inherits the parent's permissions and SELinux context.  In this case, that's mode 0755 and home_root_t, the same as /home/.  /home/user_existing/ should look more like /home/userold/.\r\n\r\n<!--- Paste verbatim command output between quotes below -->\r\n```\r\n# ls -lZd /home/user*\r\ndrwxr-xr-x.   user_existing     user_existing     unconfined_u:object_r:home_root_t:s0 /home/user_existing\r\ndrwx------.   user_not_existing user_not_existing unconfined_u:object_r:user_home_dir_t:s0 /home/user_not_existing\r\ndrw-------.   user_existing     user_existing     unconfined_u:object_r:user_home_dir_t:s0 /home/userold\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/comments/277955393","html_url":"https://github.com/ansible/ansible-modules-core/issues/5481#issuecomment-277955393","issue_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/5481","id":277955393,"user":{"login":"fzdarsky","id":13062727,"avatar_url":"https://avatars.githubusercontent.com/u/13062727?v=3","gravatar_id":"","url":"https://api.github.com/users/fzdarsky","html_url":"https://github.com/fzdarsky","followers_url":"https://api.github.com/users/fzdarsky/followers","following_url":"https://api.github.com/users/fzdarsky/following{/other_user}","gists_url":"https://api.github.com/users/fzdarsky/gists{/gist_id}","starred_url":"https://api.github.com/users/fzdarsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fzdarsky/subscriptions","organizations_url":"https://api.github.com/users/fzdarsky/orgs","repos_url":"https://api.github.com/users/fzdarsky/repos","events_url":"https://api.github.com/users/fzdarsky/events{/privacy}","received_events_url":"https://api.github.com/users/fzdarsky/received_events","type":"User","site_admin":false},"created_at":"2017-02-07T10:12:04Z","updated_at":"2017-02-07T10:12:04Z","body":"Confirming issue exists also in Ansible 2.2.1.0 on Fedora 25."}}
{"actor":{"display_login":"fzdarsky"}}