Due to a bug in rpm-ostree, the /etc/shadow, /etc/shadow-, /etc/gshadow and /etc/gshadow- files in Fedora CoreOS, IoT, Atomic Desktops have the world-readable bit set. Affected versions All Fedora CoreOS nodes installed starting from the following versions are impacted: stable: 38.20230902.3.0 testing: 38.20230902.2.1 next: 38.20230902.1.1 Fedora IoT and Fedora Atomic Desktops (Silverblue, Kinoite, Sway Atomic, Budgie Atomic) systems that were installed from Fedora 39 and later release media...

Just a heads-up for the newer Fedora Atomic users out there, and a focus on this part for the longer-term users:

This only impacts new installations and not updated systems thus systems installed from artifacts before those releases are not impacted (Fedora 38 or earlier).

  • NaNEnglish
    1•1 month ago

    ls -Z in any user home will show they are unconfined_u (so will id -Z).