I ran into this bug as well and checked if it's also present in Debian. It appears that from spamassassin 3.4.0-2 the relevant code is:
# Update umask 022 env -i LANG="$LANG" PATH="$PATH" start-stop-daemon \ --chuid debian-spamd:debian-spamd --start \ --exec /usr/bin/sa-update -- \ --gpghomedir /var/lib/spamassassin/sa-update-keys 2>&1 When using start-stop-daemon to invoke sa-update the umask is not changed, so updating to this version will fix the bug. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1373560 Title: /etc/cron.daily/spamassassin calls sa-update with potentially incorrect umask To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/spamassassin/+bug/1373560/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs