'systemd --user' unduly forces umask=0022
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
systemd |
Unknown
|
Unknown
|
|||
systemd (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bionic |
Fix Released
|
Medium
|
Dan Streetman |
Bug Description
[impact]
pam_umask, from /etc/passwd, is not honored in systemd --user instances
[test case]
on a desktop system, edit /etc/passwd to change the test user entry (e.g. the 'ubuntu' user) to include 'umask=007' in the GECOS field (5th field). For example change:
ubuntu:
to:
ubuntu:
You may need to reboot for your X session to pick up the change.
Then, from the graphical desktop, open a terminal and run:
$ gnome-terminal -e sh
in the opened terminal, run:
$ umask
the number shown should be 0007, as set in the passwd file
[regression potential]
any regression would likely result in an incorrect umask for the user whose passwd entry is modified.
[scope]
this is needed only for b
this is fixed in systemd upstream by commit 5e37d1930b41b24
[original description]
In order to set the default umask of my users to 027 or 007, I followed the instructions provided in 'man pam_umask' :
In the 'gecos' field of '/etc/passwd', I have inserted 'umask=027' or 'umask=007' (for myself).
Then, MOST graphical applications systematically run with the correct umask.
In particular, when I press Alt-F2, run 'xterm sh' and type 'umask', it systematically displays 0007.
But when I press Alt-F2, run 'gnome-terminal -e sh' and type 'umask', it systematically displays 0022.
That is BAD, and is a security issue.
Workaround : Inside the newly created '/etc/profile.
UMASK="$(grep -o "^$USER:
if [ "$UMASK" ]; then
umask "${UMASK#
fi
In fact, 'gnome-terminal' MUST NOT force umask=022, but keep umask unchanged.
Thank you in advance for a quick correction.
ProblemType: Bug
DistroRelease: Ubuntu 17.04
Package: gnome-terminal 3.20.2-1ubuntu8
ProcVersionSign
Uname: Linux 4.10.0-19-generic x86_64
ApportVersion: 2.20.4-0ubuntu4
Architecture: amd64
CurrentDesktop: X-Cinnamon
Date: Mon Apr 24 08:36:58 2017
InstallationDate: Installed on 2017-03-28 (26 days ago)
InstallationMedia: Ubuntu-GNOME 17.04 "Zesty Zapus" - Beta amd64 (20170321)
SourcePackage: gnome-terminal
UpgradeStatus: No upgrade log present (probably fresh install)
Changed in gnome-terminal: | |
importance: | Unknown → Medium |
status: | Unknown → Confirmed |
Changed in gnome-terminal: | |
importance: | Medium → Unknown |
status: | Confirmed → Unknown |
Changed in gnome-terminal: | |
importance: | Unknown → Medium |
status: | Unknown → Confirmed |
tags: | removed: focal |
summary: |
- gnome-terminal unduly forces umask=0022 + 'systemd --user' unduly forces umask=0022 |
Changed in gnome-terminal (Ubuntu): | |
status: | Confirmed → Invalid |
Changed in dbus (Ubuntu): | |
status: | Confirmed → Invalid |
Changed in gnome-session: | |
status: | New → Invalid |
Changed in nautilus: | |
status: | Confirmed → Invalid |
Changed in gnome-terminal (Ubuntu Bionic): | |
status: | New → Invalid |
Changed in dbus (Ubuntu Bionic): | |
status: | New → Invalid |
description: | updated |
Changed in systemd (Ubuntu Bionic): | |
assignee: | nobody → Dan Streetman (ddstreet) |
importance: | Undecided → Medium |
status: | Confirmed → In Progress |
no longer affects: | dbus (Ubuntu) |
no longer affects: | dbus (Ubuntu Bionic) |
no longer affects: | gnome-terminal (Ubuntu) |
no longer affects: | gnome-terminal (Ubuntu Bionic) |
affects: | nautilus → ubuntu-translations |
no longer affects: | ubuntu-translations |
affects: | gedit → ubuntu-translations |
no longer affects: | ubuntu-translations |
affects: | gnome-session → ubuntu-translations |
no longer affects: | ubuntu-translations |
affects: | gnome-terminal → ubuntu-translations |
no longer affects: | ubuntu-translations |
I set my umask in my .profile to 0027.
When I run most applications in my GNOME session, e.g. Emacs, or another terminal, such as xterm, the umask within is 0027.
When I run gnome-terminal (3.18.3, Ubuntu 16.04), my umask is 0002.
As far as I can tell, I am starting gnome-terminal and xterm (also tried uxterm) in the same way. Both are configured not to start a login shell.
If I run "umask" at the top of my .bashrc, in gnome-terminal it prints 0002, and in xterm, 0027.
If I run xterm from within gnome-terminal, the umask remains 0002.
Running gnome-terminal.real directly has the same effect.
I tried killing gnome-terminal- server and running gnome-terminal: same result.
If I set the umask in my .bashrc, then the setting is respected.