Package: login (Filing this, to track the TODOs from the discussion that followed http://lists.debian.org/debian-devel/2010/05/msg00887.html)
login.defs should contain UMASK 022 while pam_umask conditionally relaxes it to 002 for private usergroups. (Like it used to be before PAM was introduced, without pam_umask support at that time.) A UPG usage text: https://wiki.ubuntu.com/MultiUserManagement Here is a draft for the login.defs comments: --8<----- cut here ---------- # # Login configuration initializations: # # ERASECHAR Terminal ERASE character ('\010' = backspace). # KILLCHAR Terminal KILL character ('\025' = CTRL/U). # UMASK Default "umask" value. # # The ERASECHAR and KILLCHAR are used only on System V machines. # Prefix these values with "0" to get octal, "0x" to get hexadecimal. # ERASECHAR 0177 KILLCHAR 025 # # On PAM-enabled systems the UMASK setting in this file is used as a # global default by pam_umask. (See man pam_umask for global and per # user overrides.) Setting the umask in any shell rc files # (i.e. /etc/profile and others) instead of with pam_umask is # depreciated because they don't catch all classes of user entry # to the system. # # On non-PAM (login) systems setting the umask in shell rc files, in # addition to the UMASK setting here, can catch some more classes of # user entries to system. (Logins through su, cron, ssh etc.) # At the same time, using shell rc files to set umask won't catch cases # which use non-shell executables in place of a login shell, # like /usr/sbin/pppd for the "ppp" user and alike. # # UMASK 022 is the default value in Debian, # 027 or even 077 could be considered better for privacy, if # user private groups (UPGs) have been disabled (see /etc/adduser.conf # and option USERGROUPS_ENAB below), the home directories have all been # created with restriced permissions (adduser.conf) and the users in the # system are not to trust each other to read each other's files # they created in accessible directories. # There is no One True Answer here: Each sysadmin must make up his/her # mind. # # Note that with login's USERGROUPS_ENAB feature, or # with the "usergroups" feature of pam_umask (debian default), # if a user has been created with a user private group (UPG) that user's # group permission umask value is adjusted to match the user permission # value (i.e. 022->002). This enables flawless collaboration for UPG # users in group directories, without risking a too permissive system # wide default. UMASK 022 --8<--------------- -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
