[SSSD] Review of umask() in SSSD

Jakub Hrozek jhrozek at redhat.com
Sun Oct 4 19:20:17 UTC 2015


On Sun, Oct 04, 2015 at 09:15:05PM +0200, Jakub Hrozek wrote:
> On Thu, Oct 01, 2015 at 02:06:50PM +0200, Petr Cech wrote:
> > On 10/01/2015 01:19 PM, Jakub Hrozek wrote:
> > >On Thu, Oct 01, 2015 at 12:38:49PM +0200, Petr Cech wrote:
> > >>Bump.
> > >
> > Thanks for reply, Jakub.
> > 
> > >Why was 077 changed for 0177?
> > This change is something, which I think was discussed earlier in this
> > thread.
> > 
> > # pcech:
> > # > I would like to ask you if we would like to use 0077 or 0177 as our very
> > # > restrictive mask. I see that our code is not consistent on this
> > question. I
> > # > know the difference is small, but it is.
> > #
> > # jhrozek:
> > # I guess 0177 should be used.
> 
> Ah, then we misunderstood each other. What I meant was umask what we
> should use going forward, when adding new umask calls to SSSD. The
> reason I was proposing using 177 over 077 is simply that it's even
> more restrictive - not even the owner can set the executable
> permissions.
> 
> I'm not opposed to restricting permissions further, but i) there should
> be a patch per change, otherwise this kind of changes gets tricky to
> review, fast and ii) definitely not part as this patch.

OK, this might have been still confusing :-)

With this patch, I think we can have one more #define along with the
defult that also allows u=x, maybe called DFL_X_UMASK or similar. Then,
if you think the umasks should be tightened, please send a patch per
change with an explanation of the the change is desired in the commit
message.


More information about the sssd-devel mailing list