ecryptfs-migrate-home uses hardcoded /home

[Darin]

ecryptfs-migrate-home uses a hardcoded /home in encrypt_dir () and sanity_check () which causes the program to fail when /home is an automount or if another root for home directories has been set via /etc/default/useradd, i.e /local/home. Haven't had a chance to start working on a patch yet, I wanted to get the bug filed before I forgot.

[Darin (darinp)]

Attached is a patch for ecryptfs-migrate-home and ecryptfs-setup-private which removes the hardcoded /home and pulls in the $HOME value from /etc/default/useradd.

[Tyler Hicks (tyhicks)]

Hi Darin - Thanks for the bug report and also for the patch!

Here are some potential problems that I see with the patch:

eCryptfs scripts shouldn't be sourcing config files for other programs.
migrate-home must be run under the root user, so that makes me even more
uncomfortable about eCryptfs scripts sourcing scripts that we have no control
over and can't guarantee the content or structure of.

Also, your patch makes the assumption that $HOME is set in
/etc/default/useradd. That may not always be true.

There are other user management tools that, I assume, do not respect
/etc/default/useradd. Also, if someone uses adduser/useradd with the --home
option, they can place the home directory anywhere. /etc/default/useradd would
not be helpful in that situation.

$USER_HOME is already pulled out of /etc/passwd, so it should be accurate. How
about just running it through dirname and setting that to $BASE_HOME?

[Darin (darinp)]

Hi Tyler,

I started thinking about when home directories are set manually with -d, and how the patch wouldn't addresses those use cases after I sent in the patch earlier, which had me thinking that using dirname to set it on a user by user basis would be the best approach. So yes, I agree that using dirname and setting it to $BASE_HOME is the best approach.

FWIW, and I'm sure you know this, $USER_HOME is retrieved with getent passwd and not directly from /etc/passwd. This will cover local and users retrieved from an external sources should the system be using pam_mkhomedir to create local home directories for those network users.

Thanks!
--
Darin