shadow files are user readable

[champtar]

Scanning my system using oscap / cis profile,
shadow files have incorrect permissions

Host system details
Alma 8.7 based OS

Expected vs actual behavior

# ls -l /etc/*shadow*
-r--------. 1 root root 225 Dec  5 09:18 /etc/gshadow
-r--------. 1 root root 213 Oct 25  2022 /etc/gshadow-
-r--------. 1 root root 436 Apr 18 11:37 /etc/shadow
-r--------. 1 root root 397 Oct 25  2022 /etc/shadow-

Expected:
shadow files should have mode 0000

Steps to reproduce it
The shadow files in /usr/etc have mode 0400 on purpose 334f0b8
This seems to be a side effect

chmod 0000 /etc/*shadow* doesn't break my system

Maybe we can fix it using tmpfile.d config

$ cat /usr/lib/tmpfiles.d/rpm-ostree-shadow.conf
z /etc/shadow 0000 root root -
z /etc/shadow- 0000 root root -
z /etc/gshadow 0000 root root -
z /etc/gshadow- 0000 root root -

see also #1045

Would you like to work on the issue?
No

[cgwalters]

Ultimately what we want I think is for the shadow files to not exist in the ostree commit at all. Instead we should generate them on first boot if they don't exist. This may require OS level work.

[champtar]

Instead we should generate them on first boot if they don't exist. This may require OS level work.

We could have rpm-ostree generate them when missing when 'unpacking' a commit

[champtar]

this triggers SELinux

(typeattributeset cil_gen_require systemd_tmpfiles_t)
(typeattributeset cil_gen_require shadow_t)
(allow systemd_tmpfiles_t shadow_t (file (getattr setattr relabelfrom relabelto)))