On Thu, Oct 01, 2015 at 02:06:50PM +0200, Petr Cech wrote:
On 10/01/2015 01:19 PM, Jakub Hrozek wrote:
>On Thu, Oct 01, 2015 at 12:38:49PM +0200, Petr Cech wrote:
>>Bump.
>
Thanks for reply, Jakub.
>Why was 077 changed for 0177?
This change is something, which I think was discussed earlier in this
thread.
# pcech:
# > I would like to ask you if we would like to use 0077 or 0177 as our very
# > restrictive mask. I see that our code is not consistent on this
question. I
# > know the difference is small, but it is.
#
# jhrozek:
# I guess 0177 should be used.
Ah, then we misunderstood each other. What I meant was umask what we
should use going forward, when adding new umask calls to SSSD. The
reason I was proposing using 177 over 077 is simply that it's even
more restrictive - not even the owner can set the executable
permissions.
I'm not opposed to restricting permissions further, but i) there should
be a patch per change, otherwise this kind of changes gets tricky to
review, fast and ii) definitely not part as this patch.