Re: Default "tar" umask..

From: Junio C Hamano <junkio@cox.net>
Date: Dec 30, 2006, 19:27 UTC
Message-ID: <7vfyaxjiaj.fsf@assigned-by-dhcp.cox.net>
In-Reply-To: <Pine.LNX.4.64.0612301037570.4473@woody.osdl.org>

Linus Torvalds <torvalds@osdl.org> writes:

> We just had a posting on the kernel security list where a person was 
> upset that the 2.6.19.1 and .2 tar-files were apparently group and 
> world-writable.

I had an impression that this is only an issue when you untar as root, and running 'tar xf' as root _is_ a more serious security issue than whatever permission the tar archive itself records.

Having said that, I do not see much reason for anybody to want to extract any material that is worth to be placed under version control in a way that is world-writable, so I do not mind having 002 as the default, but I feel that group-writability should be kept under control of the umask of end users who know what they are doing.

Historically we used to have 022 as the default, and IIRC we loosened it exactly because some people hated that we created files and directories closed to group members.