On Sun, Oct 04, 2015 at 09:15:05PM +0200, Jakub Hrozek wrote:
On Thu, Oct 01, 2015 at 02:06:50PM +0200, Petr Cech wrote:
> On 10/01/2015 01:19 PM, Jakub Hrozek wrote:
> >On Thu, Oct 01, 2015 at 12:38:49PM +0200, Petr Cech wrote:
> >>Bump.
> >
> Thanks for reply, Jakub.
>
> >Why was 077 changed for 0177?
> This change is something, which I think was discussed earlier in this
> thread.
>
> # pcech:
> # > I would like to ask you if we would like to use 0077 or 0177 as our very
> # > restrictive mask. I see that our code is not consistent on this
> question. I
> # > know the difference is small, but it is.
> #
> # jhrozek:
> # I guess 0177 should be used.
Ah, then we misunderstood each other. What I meant was umask what we
should use going forward, when adding new umask calls to SSSD. The
reason I was proposing using 177 over 077 is simply that it's even
more restrictive - not even the owner can set the executable
permissions.
I'm not opposed to restricting permissions further, but i) there should
be a patch per change, otherwise this kind of changes gets tricky to
review, fast and ii) definitely not part as this patch.
OK, this might have been still confusing :-)
With this patch, I think we can have one more #define along with the
defult that also allows u=x, maybe called DFL_X_UMASK or similar. Then,
if you think the umasks should be tightened, please send a patch per
change with an explanation of the the change is desired in the commit
message.