Date: Thu, 8 Oct 2020 21:02:13 +0000 From: Seth Arnold <seth.arnold@...onical.com> To: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> Cc: oss-security@...ts.openwall.com Subject: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 On Thu, Oct 08, 2020 at 08:29:39AM -0500, Bob Friesenhahn wrote: > It seems that the issue we encountered is due to 'USERGROUPS_ENAB yes' in > /etc/login.defs. I am not sure if this is specific to Ubuntu. This setting > changes the umask from the default: Aha, thanks for indulging my curiosity and tracking this down. Ubuntu doesn't carry any changes to this package compared to the Debian package (any differences would be in a 'login' directory in https://patches.ubuntu.com/l/ ). "USERGROUPS_ENAB yes" may have been a Debian default setting since 1999 or so; archaelogy on packages this old is a little difficult, but the tarball on: https://sources.debian.org/src/shadow/19990827-20/ has several login.defs* files: $ ls -l etc/login.defs* -rw-r--r-- 1 sarnold sarnold 5426 May 1 1997 etc/login.defs -rw-r--r-- 1 sarnold sarnold 4272 Aug 27 1999 etc/login.defs.hurd -rw-r--r-- 1 sarnold sarnold 10165 Aug 27 1999 etc/login.defs.linux $ grep USERGROUPS etc/login.* etc/login.defs.hurd:USERGROUPS_ENAB yes etc/login.defs.linux:USERGROUPS_ENAB yes By 2005 or so, the archaelogy gets easier: https://sources.debian.org/src/shadow/1:18.104.22.168-7+etch1/etc/login.defs/ https://sources.debian.org/src/shadow/1:22.214.171.124-7+etch1/debian/changelog/ I believe "USERGROUPS_ENAB yes" has been a Debian default since 1998 or 1999. Thanks Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.