On 10/6/22 16:46, Damien Miller wrote: > On Tue, 4 Oct 2022, Alex Henrie wrote: > >> Daniel Kahn Gillmor suggested this exact change on the openssh-unix-dev >> mailing list in 2008, but I couldn't find any reply. [1] >> >> Ignoring the current umask makes it hard to fulfill the Defense >> Information Systems Agency's Security Technical Implementation Guide. In >> particular, it requires: >> >> "The Red Hat Enterprise Linux operating system must be configured so >> that all files and directories contained in local interactive user home >> directories have a mode of 0750 or less permissive." [2] >> >> "The Red Hat Enterprise Linux operating system must set the umask value >> to 077 for all local interactive user accounts." [3] > Thanks - applied with a slight tweak: > > - umask(022); > + umask(022 | umask(077)); > > which better matches what we do in sshd. That looks great, thank you!
-Alex
