[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 8 Oct 2020 21:02:13 +0000
From: Seth Arnold <seth.arnold@...onical.com>
To: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
Cc: oss-security@...ts.openwall.com
Subject: Re: Debian FEATURE: /home/loser is with permissions
755, default umask 0022
On Thu, Oct 08, 2020 at 08:29:39AM -0500, Bob Friesenhahn wrote:
> It seems that the issue we encountered is due to 'USERGROUPS_ENAB yes' in
> /etc/login.defs. I am not sure if this is specific to Ubuntu. This setting
> changes the umask from the default:
Aha, thanks for indulging my curiosity and tracking this down. Ubuntu
doesn't carry any changes to this package compared to the Debian
package (any differences would be in a 'login' directory in
https://patches.ubuntu.com/l/ ).
"USERGROUPS_ENAB yes" may have been a Debian default setting since 1999 or
so; archaelogy on packages this old is a little difficult, but the tarball
on:
https://sources.debian.org/src/shadow/19990827-20/
has several login.defs* files:
$ ls -l etc/login.defs*
-rw-r--r-- 1 sarnold sarnold 5426 May 1 1997 etc/login.defs
-rw-r--r-- 1 sarnold sarnold 4272 Aug 27 1999 etc/login.defs.hurd
-rw-r--r-- 1 sarnold sarnold 10165 Aug 27 1999 etc/login.defs.linux
$ grep USERGROUPS etc/login.*
etc/login.defs.hurd:USERGROUPS_ENAB yes
etc/login.defs.linux:USERGROUPS_ENAB yes
By 2005 or so, the archaelogy gets easier:
https://sources.debian.org/src/shadow/1:4.0.18.1-7+etch1/etc/login.defs/
https://sources.debian.org/src/shadow/1:4.0.18.1-7+etch1/debian/changelog/
I believe "USERGROUPS_ENAB yes" has been a Debian default since 1998 or 1999.
Thanks
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
