On Sat, 10 Feb 2024 at 23:52, John Helmert III <[email protected]> wrote: > > On Sat, Feb 10, 2024 at 05:57:08PM +0100, Daniel Simionato wrote: > > Hello, > > I'd like to start a discussion regarding setting HOME_MODE by default in > > the /etc/login.defs file (owned by sys-apps/shadow package). > > > > Upstream keeps HOME_MODE commented: > > https://github.com/shadow-maint/shadow/blob/3e59e9613ec40c51c19c7bb5c28468e33a4529d5/etc/login.defs#L207 > > > > HOME_MODE affects only useradd and newuser commands: if HOME_MODE is set, > > they will use the specified permission when creating a user home directory, > > otherwise the default UMASK will be used. > > Since the default umask is 022, keeping HOME_MODE unset will result in home > > readable home directories created by useradd, which goes against security > > best practices. > > > > The proposal is to set HOME_MODE to 0700, or at least 0750: RedHat and RH > > based distros, OpenSuse, ArchLinux all set it to 0700, Ubuntu has it at > > 0750. Debian and Gentoo are two exceptions, keeping the upstream value of > > HOME_MODE (although login.defs is changed in other ways). > > > > I previously made a PR on github where you can find more details ( > > https://github.com/gentoo/gentoo/pull/35231), but as pointed in the > > comments this probably warrants some discussion beforehand. > > > > I can understand the argument against the change, which is keeping in sync > > with upstream and don't risk changing the historic default behaviour of > > tools some users might rely upon. > > > > I do believe though there's merit in providing safer and secure defaults, > > so I would like HOME_MODE to have a safe default value for Gentoo and > > Gentoo based distros. > > Setting it to 0700 makes good sense to me, unless someone has some > good example of this breaking anything. Deviating from upstream > defaults in following other distributions isn't exactly treading new > ground for us. And it's easy for the administrator to change to suit > their liking anyway (hopefully covering the "keep the status quo" > class of objections). > > > Have a nice day, > > Daniel
0700 should be the default as far as I'm concerned. 750 makes sense in some environments, but in those environments a sysadmin should know well enough to make the changes when it is useful. I never understood why world readable was default on Gentoo.
