Due to a bug in rpm-ostree, the /etc/shadow, /etc/shadow-, /etc/gshadow and /etc/gshadow- files in Fedora CoreOS, IoT, Atomic Desktops have the world-readable bit set. Affected versions All Fedora CoreOS nodes installed starting from the following versions are impacted: stable: 38.20230902.3.0 testing: 38.20230902.2.1 next: 38.20230902.1.1 Fedora IoT and Fedora Atomic Desktops (Silverblue, Kinoite, Sway Atomic, Budgie Atomic) systems that were installed from Fedora 39 and later release media...

Just a heads-up for the newer Fedora Atomic users out there, and a focus on this part for the longer-term users:

This only impacts new installations and not updated systems thus systems installed from artifacts before those releases are not impacted (Fedora 38 or earlier).

  • barbara
    22·
    7 months ago

    Isn’t selinux enabled by default? Hence, most won’t be affected.

    On systems with SELinux enabled and in enforcing mode, access to those files is limited to unconfined (usually interactive) users, unconfined systemd services and privileged containers. Confined daemons, users and containers are not able to access them.

    • dsemy@lemm.eeEnglish
      4·
      7 months ago

      I’m not sure you’re right, I can’t find information regarding whether users are confined by default on Fedora (Red Hat docs seem to indicate the users are unconfined by default).

      Edit: They are not, see https://docs.fedoraproject.org/en-US/quick-docs/selinux-getting-started/#_selinux_examples, specifically:

      SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux user_u user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as sudo and su, as well as preventing them from executing files and applications in their home directory. If configured, this prevents users from executing malicious files from their home directories.