Interpretation of the additional traces triggered by Gnome terminal
-------------------------------------------------------------------
The 'bash' trace logically comes from the 'umask 007' command in my '.bashrc' file.
Since 0022=0x12, the suspect for 'umask 022' hardcoding is '(l-server)'.
Thanks to Seth Arnold for his advices to use the 'perf' or 'auditd' tools.
Inside the example '/var/log/ audit/audit. log' which he provided, I do NOT find the 'umask' string.
So, I prefer to begin installing and using the 'perf' tool :
$ sudo apt-get install linux-tools-generic
Close the graphical session.
Record 'umask' for a Gnome session without doing anything ------- ------- ------- ------- ------- ------- ------- -
-------
Switch to a console (tty2), and login.
$ sudo perf record -ag -e syscalls: sys_enter_ umask
Switch to the 'gdm' login screen.
Open a Gnome session, then immediately close it.
Switch to the console (tty2).
Press Ctrl-C.
... (325 samples)
$ sudo perf script > gnome-umask.log
Record 'umask' for a Gnome session with a Gnome terminal ------- ------- ------- ------- ------- ------- -------
-------
$ sudo perf record -ag -e syscalls: sys_enter_ umask
Switch to the 'gdm' login screen.
Open a Gnome session.
Inside the Gnome session, open a Gnome terminal with Ctrl-Alt-T.
Close the Gnome terminal with Ctrl-D.
Close the Gnome session.
Switch to the console (tty2).
Press (Ctrl C).
... (329 samples)
$ sudo perf script > gnome-umask- with-gnome- terminal. log
Additional traces triggered by Gnome terminal ------- ------- ------- ------- ------- --- with-gnome- terminal. log
-------
Following command eases the discovery of the additional traces :
$ diff -I '[0-9]* *\[ *[0-9]* *\] *[0-9.]*' gnome-umask.log gnome-umask-
> systemd-journal 360 [005] 10229.742513: syscalls: sys_enter_ umask: mask: 0x0000003f 64-linux- gnu/libc- 2.24.so) sys_enter_ umask: mask: 0x00000012 64-linux- gnu/libc- 2.24.so) sys_enter_ umask: mask: 0x00000012 64-linux- gnu/libc- 2.24.so) systemd) sys_enter_ umask: mask: 0x00000007 64-linux- gnu/libc- 2.24.so)
> f7907 __GI___umask (/lib/x86_
> 0 [unknown] ([unknown])
>
> systemd-journal 360 [005] 10229.742521: syscalls:
> f7907 __GI___umask (/lib/x86_
>
> (l-server) 12464 [003] 10229.742634: syscalls:
> f7907 __GI___umask (/lib/x86_
> 8f2af [unknown] (/lib/systemd/
>
> bash 12472 [005] 10229.881381: syscalls:
> f7907 __GI___umask (/lib/x86_
> 1e0e1a8 [unknown] ([unknown])
Interpretation of the additional traces triggered by Gnome terminal ------- ------- ------- ------- ------- ------- ------- ------- ----
-------
The 'bash' trace logically comes from the 'umask 007' command in my '.bashrc' file.
Since 0022=0x12, the suspect for 'umask 022' hardcoding is '(l-server)'.