From darrenm@sac.sfbay.sun.com Tue Oct 28 05:18:45 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9SCIir4016626 for ; Tue, 28 Oct 2008 05:18:44 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m9SCIGt8024783; Tue, 28 Oct 2008 12:18:43 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9G009017J3HU00@nwk-avmta-2.sfbay.sun.com>; Tue, 28 Oct 2008 05:18:39 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K9G00IQJ7J2XFD0@nwk-avmta-2.sfbay.sun.com>; Tue, 28 Oct 2008 05:18:38 -0700 (PDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m9SCIcXC037934; Tue, 28 Oct 2008 05:18:38 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9SCIbKe016620; Tue, 28 Oct 2008 05:18:37 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m9SCIb3S016616; Tue, 28 Oct 2008 05:18:37 -0700 (PDT) Date: Tue, 28 Oct 2008 05:18:37 -0700 (PDT) From: Darren J Moffat Subject: GDM system user home directory [PSARC/2008/662 FastTrack timeout 11/04/2008] To: PSARC-ext@sun.com Cc: Brian.Cameron@sun.com Message-id: <200810281218.m9SCIb3S016616@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 2131 Template Version: @(#)sac_nextcase %I% %G% SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: GDM system user home directory 1.2. Name of Document Author/Supplier: Author: Darren Moffat 1.3 Date of This Document: 28 October, 2008 4. Technical Description The current system 'gdm' user has '/' as its home directory. Future versions of the GDM (2.26) login program uses GConf for the GUI programs and requires that the "gdm" user have a writable $HOME directory usually set to /var/lib/gdm. It would also have a benefit for the current GDM. Many a11y programs will not start unless the user has a writable $HOME directory. The JDS team have fixed the two most common a11y programs (GOK and orca) so they work without needing a writable $HOME directory, but users cannot currently use other AT programs (such as dasher) due to this limitation. The JDS team would rather not continue to need to patch every a11y program that needs to run with GDM. The /var/lib/gdm directroy already exists with owner root and group gdm write permissions, with no read/write/execute for any other user. The directory is currently used to store the Xauth keys for each display, which both the root and gdm user need access to. Since it is group writable by the "gdm" user, it works fine to save $HOME/.gconf settings and other $HOME config dot-files there (for example, if you use dasher, it wants to create $HOME/.dasher). It is good that the directory is not world readable. While the GDM Gconf configuration is not particularly security sensitive and only controls visual effects (like whether to show the face browser or not), you probably still don't want user's poking around in the gdm user's configuration. Upgrade and fresh install will have the following gdm entry: gdm:x:50:50:GDM Reserved UID:/var/lib/gdm: Release binding: patch Interface Taxonomy: Uncommitted 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Garrett.Damore@sun.com Wed Nov 5 09:40:34 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mA5HeXD7016383 for ; Wed, 5 Nov 2008 09:40:33 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mA5HeXrg060296 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Wed, 5 Nov 2008 10:40:33 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9V00L09FRJJ800@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 05 Nov 2008 09:40:31 -0800 (PST) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K9V00KXXFRH3L30@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 05 Nov 2008 09:40:29 -0800 (PST) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mA5HeT3Y001921 for ; Wed, 05 Nov 2008 09:40:29 -0800 (PST) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K9V00F01EZLIM00@fe-sfbay-09.sun.com> (original mail from Garrett.Damore@Sun.COM) for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 05 Nov 2008 09:40:29 -0800 (PST) Received: from [129.153.2.14] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K9V00A3OFR82IC0@fe-sfbay-09.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 05 Nov 2008 09:40:21 -0800 (PST) Date: Wed, 05 Nov 2008 09:40:20 -0800 From: "Garrett D'Amore" Subject: PSARC 2008/662 GDM system user home directory Sender: Garrett.Damore@sun.com To: psarc-ext@sun.com Message-id: <4911DA84.9040404@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.14 (X11/20080505) Status: RO Content-Length: 129 +1. (Mysteriously, I didn't see this case, nor a couple of others, e-mail in my mail log... not sure why not.) -- Garrett