From 99d66987b0a73df1338115981a9870f7689d1908 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:03:28 +0200 Subject: [PATCH 1/2] docs(admin_manual): document user home containment and user.home_base_dirs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A user backend can supply a per user home directory - the LDAP backend for instance can be configured to read it from a user attribute via the "User Home Folder Naming Rule" setting. That value is now confined to the data directory, because an LDAP directory is not necessarily administered by the people who administer the ownCloud server (owncloud/core#41752, owncloud/user_ldap#849). Add a CAUTION to the "User Home Folder Naming Rule" item explaining the containment, what an affected user sees, how symlinks are treated, and how to permit additional base directories with "user_ldap.home_base_dirs" or "user.home_base_dirs". Existing installations whose homes legitimately live outside of the data directory need the setting before upgrading, so that is called out explicitly. Regenerate the config parameters page with owncloud/config-to-docs from the core branch's config.sample.php, which adds the "user.home_base_dirs" section. Verified the generator reproduces the current page byte for byte from the pre-change config.sample.php, so the diff is limited to the new option. Co-Authored-By: Claude Opus 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .../server/config_sample_php_parameters.adoc | 25 +++++++++++++++++++ .../configuration/user/user_auth_ldap.adoc | 9 +++++++ 2 files changed, 34 insertions(+) diff --git a/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc b/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc index a78329a2b..4c134257b 100644 --- a/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc +++ b/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc @@ -561,6 +561,31 @@ For example, entering "tom" will always return "Tom" if there is an exact match. 'user.search_min_length' => 2, .... +=== Additional base directories a user home may be located in + +User backends can supply a per user home directory - the LDAP backend for +instance can be configured to read it from a user attribute. Such a value is +not necessarily controlled by the ownCloud administrator, so a home is only +accepted when it lies inside the configured `datadirectory`. A home pointing +at the ownCloud code directory would otherwise expose the application's own +files, and allow overwriting them. + +If user homes legitimately live outside of the data directory, for example on +a separate NFS mount, list the permitted base directories here. Any home +inside one of them is accepted. Keep this list as narrow as possible and never +include the ownCloud code directory. + +Defaults to `[]`, i.e. only the data directory is permitted. + +The LDAP backend honours the analogous `user_ldap.home_base_dirs` option. + +==== Code Sample + +[source,php] +.... +'user.home_base_dirs' => [], +.... + == Mail Parameters These configure the email settings for ownCloud notifications and password resets. diff --git a/modules/admin_manual/pages/configuration/user/user_auth_ldap.adoc b/modules/admin_manual/pages/configuration/user/user_auth_ldap.adoc index c710d04f2..4ab1bfb55 100644 --- a/modules/admin_manual/pages/configuration/user/user_auth_ldap.adoc +++ b/modules/admin_manual/pages/configuration/user/user_auth_ldap.adoc @@ -575,6 +575,15 @@ By default, the ownCloud server creates the user directory in your ownCloud data It is possible to override this setting and name it after an LDAP attribute value, e.g., `attr:cn`. The attribute can return either an absolute path, e.g., `/mnt/storage43/alice`, or a relative path which must not begin with a `/`, e.g., `CloudUsers/CookieMonster`. This relative path is then created inside the data directory (e.g., `/mnt/data/files/CloudUsers/CookieMonster`). +CAUTION: The home folder is confined to the data directory. An LDAP directory is not necessarily administered by the same people who administer the ownCloud server, so a home resolving *outside* of the data directory is refused - a home pointing at the ownCloud code directory would otherwise expose the application's own files, and allow overwriting them. The affected user cannot log in, and an error naming both the refused path and the configuration option below is written to the ownCloud log. Symbolic links are resolved before the check, so a symlinked data directory keeps working, while a symlink inside the data directory cannot be used to escape it. + +If your user home folders legitimately live outside of the data directory, for example on a separate NFS mount, list the permitted base directories in `config/config.php`, either in `user_ldap.home_base_dirs` for the LDAP backend alone, or in xref:configuration/server/config_sample_php_parameters.adoc#additional-base-directories-a-user-home-may-be-located-in[user.home_base_dirs] for every user backend. Existing installations must add the setting *before* upgrading, otherwise the affected users cannot log in afterwards. + +[source,php] +---- +'user_ldap.home_base_dirs' => ['/mnt/storage43'], +---- + Please note that the home folder rule is enforced. This means that once you set a home folder naming rule (get a home folder from an LDAP attribute), it must be available for all users. If it isn't available for a user, then that user will not be able to login. Also, the filesystem will not be set up for that user, so their file shares will not be available to other users. For older versions you may enforce the home folder rule with the `occ` command, like this example on Ubuntu: [source,bash,subs="attributes+"] From 2fc14790518b32ace20b01b6159634b1ecdf04fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:33:35 +0200 Subject: [PATCH 2/2] docs(admin_manual): note that home base dirs must be absolute paths MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Regenerated from core's config.sample.php after owncloud/core#41752 spelled out that a non-absolute entry in user.home_base_dirs is ignored - a relative one would otherwise resolve against the working directory of whichever process happens to run the containment check. Co-Authored-By: Claude Opus 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .../configuration/server/config_sample_php_parameters.adoc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc b/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc index 4c134257b..30e0dd562 100644 --- a/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc +++ b/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc @@ -575,6 +575,10 @@ a separate NFS mount, list the permitted base directories here. Any home inside one of them is accepted. Keep this list as narrow as possible and never include the ownCloud code directory. +Every entry must be an absolute path. Entries that are not are ignored, because +a relative one would be resolved against the working directory of whichever +process happens to run the check. + Defaults to `[]`, i.e. only the data directory is permitted. The LDAP backend honours the analogous `user_ldap.home_base_dirs` option.