-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Am Mo den 10. Mai 2010 um 17:14 schrieb Aaron Toponce: > $ umask 0002 > $ touch anotherfile > $ ls -l anotherfile > -rw-rw-r-- 1 foo foo 0 May 10 10:06 anotherfile > > As it sits, having the default umask set as '0022' isn't breaking > anything, but it's no longer needed. It's just historical baggage coming > from the 'users' group on older UNIX systems, where any new user added > to the system was added to the 'users' group by default. Thus, removing > the write bit made sense. It doesn't make any sense with UPG.
I still makes sense. The user will not win with the lazier umask but he will probably loose security. See the case the user wants another person in his own group to share files. Then he might set the files readable for his group only but not for world. So the other user can read this data. But he cannot write it as it might be intended. Setting the umask to 002 let the other user _edit_ all files the user did create in the past with that umask factual giving away most of his files. The better Idea would be to set the user mask to 027 which then add a new value of security. If a user want the group to have write permissions this should be set explicit. By the way, with zsh you can make directory profiles which set the umask depending on the directory. > For comparison's sake, Fedora (and as a result, RHEL/CentOS/etc) have > implemented '0002' as their default umask, as they implement UPG. Yes. And that is one big security issue! > I guess I'm more or less curious why we're still using this outdated > umask value with UPG. What would it take for Debian to update our > default umask to match the UPG scheme? Is this doable for Sqeeze? Are > there reasons for not making the switch? Hopefully not! Regards Klaus - -- Klaus Ethgen http://www.ethgen.de/ pub 2048R/D1A4EDE5 2000-02-26 Klaus Ethgen <kl...@ethgen.de> Fingerprint: D7 67 71 C4 99 A6 D4 FE EA 40 30 57 3C 88 26 2B -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEVAwUBS+hZg5+OKpjRpO3lAQrqxQf/Y0tHKXEiHnQePMxs/DItSecDn/aw+gsN qcTsKw4qU6Wk95KsV5LLsRTT7uFN9/RtOtz+KUa0YaWIyLVKGMxjRbQYFceaG490 gY5QlK1AVrqHDdFipLUK12mgb63s9VDMxFqXFHpUPa5GFbMQ6RGcrN3KbxIVNeG7 khcHhOqOiATC7E0GN4jg+eSGqmD/szSlLqKBaJJVfbPbG2T91NvZqxG+cXLwuhpW cYQqpxVA9jYLFhEBq4Fe5JhEFOUfcV+zxT8BJ0TVVsvuzvN7M5PJV7Pb9XaBXeCz HsHU+7+Yojt2r03KeFwacjg65xZvVqQPEFNWBnnJCcd9qMdsI3iIuw== =qeHa -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100510190747.gc19...@ikki.ethgen.de