User accounts on Tool Labs have a .bashrc file that is managed by puppet, that sets ls to use colour, adds ls aliases, and some other stuff. The file is not automatically added for tool accounts. I don't know whether this behaviour is intended or not, but it would be extremely useful to have it for tool accounts.
|Open||None||T131561 Tool Labs users .bashrc file does not exist for tools accounts|
|Open||None||T91235 Use skeleton home directories and PAM as a base for maintain-dbusers and maintain-kubeusers|
|Open||None||T116815 Add all service group users to a project-servicegroups-$project by default|
|Open||None||T180723 Load .bashrc when using become|
The ~/.bashrc file for users does not come from Puppet, but from the bash package:
scfc@tools-bastion-05:~$ dpkg-query -S /etc/skel/.bashrc bash: /etc/skel/.bashrc scfc@tools-bastion-05:~$
When a user logs in for the time, the home directory gets created and prefilled from /etc/skel by pam_mkhomedir.so.
I think nowaways that module is also triggered by tools with sudo (/etc/pam.d/sudo => @include common-session-noninteractive => session [success=ok new_authtok_reqd=ok default=ignore] pam_mkhomedir.so umask=0077), but as toolwatcher will create the tool's directory usually before the user sudos to become the tool, there is an existing (almost empty) home directory for the tool account, so pam_mkhomedir.so doesn't copy /etc/skel over.
toolwatcher creates ~/public_html (which one could do without), but more importantly sets the setgid bit on a tool's home directory, so the umask part of the PAM rule would need to be split between user accounts (where the group wikidev is shared with all user and thus files should not be readable/writable by the primary group) and tool accounts (where that is the whole point).
(The duties of toolwatcher have been passed onto maintain-kubeusers and ~/public_html is no longer created.) I believe that currently a lot of logic depends on "home directory does not exist" → "do this and that", so changing it is much risky work with not very much benefit (and understanding the PAM flow makes my brain hurt :-)). But in theory your concept should work.