#1100924 systemd-sysusers module creates unreadable shadow and gshadow

Package:
dracut-core
Source:
dracut-core
Description:
dracut is an event driven initramfs infrastructure (core tools)
Submitter:
Anton Lundin
Date:
2025-03-20 14:12:02 UTC
Severity:
normal
#1100924#5
Date:
2025-03-20 14:10:21 UTC
From:
To:
When building a initramfs with dracut as a non-root-user the cpio step
fails:
cpio: etc/gshadow: Cannot open: Permission denied
cpio: etc/shadow: Cannot open: Permission denied

The systemd-sysusers step creates 000 shadow and gshadow files, which
causes a non-root-user to fail to try to read those files, failing the
whole dracut initramfs building.

This could be considered a bug in systemd-sysusers, but can easlily be
worked around by:
--- /usr/lib/dracut/modules.d/60systemd-sysusers/module-setup.sh.orig	2025-03-20 15:09:38.537420997 +0100
+++ /usr/lib/dracut/modules.d/60systemd-sysusers/module-setup.sh	2025-03-20 15:09:40.093398782 +0100
@@ -16,4 +16,6 @@
     inst_sysusers basic.conf

     systemd-sysusers --root="$initdir"
+
+    chmod 640 "$initdir"/etc/shadow "$initdir"/etc/gshadow
 }



//Anton