severity 583967 serious
thanks
* Philipp Kern ([email protected]) [100601 13:55]:
> should #583967 be RC? If I see it correctly it will "only" affect new
> installs because the /etc/profile file is not automatically updated. But
> calling this unconditionally sounds wrong:
>
> | if [ "`id -u`" -ge 1000 ] && [ "`id -u`" -le 29999 ]; then
> | umask 002
> | else
> | umask 022
> | fi
>
> (Currently in testing.)
>
> As discussed on debian-devel we really, really want the additional sanity
> checks pam_umask provides.
After some more thinking, I need to say:
We can not release with this code present.
(i.e. this bug report is RC-grade). This will break new installs in
many environments without usergroups, like e.g. debian.org machines.
I appreciate the goal to get better support for
usergroup-environments, but doing it wrong only causes pain. The right
way seems to me to call pam_umask with the option "usergroups", which
has the following sanity checks that this code misses:
If [...] the user ID is equal to the group ID, and the username is
the same as primary group name,
Also, pam is the obvious place for such a thing.
Andi
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
