Bug 2062601

/etc/profile belongs to setup package, so reassigning

RHEL8 had the code:

...
export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL

# By default, we want umask to get set. This sets it for login shell
# Current threshold for system reserved uid/gids is 200
# You could check uidgid reservation validity in
# /usr/share/doc/setup-*/uidgid file
if [ $UID -gt 199 ] && [ "`/usr/bin/id -gn`" = "`/usr/bin/id -un`" ]; then
    umask 002
else
    umask 022
fi

for i in /etc/profile.d/*.sh /etc/profile.d/sh.local ; do
...

but it is missing in RHEL9, and I do not see any recent changelog entry that would correspond to such change(?)

fixed in fedora:

https://pagure.io/setup/c/692ca425c4d39fb150bede011082e6bfd4472fe5?branch=master

now I am confused ...

the bug description says the umask should be 0002

the fix is about dropping uid check and results in 0022 - which is a change from previous release

so ... setting 0002 is now considered incorrect?

RHEL8:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Setup
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 11:50:52 ] :: [   PASS   ] :: Checking for the presence of setup rpm 
:: [ 11:50:52 ] :: [   LOG    ] :: Package versions:
:: [ 11:50:52 ] :: [   LOG    ] ::   setup-2.12.2-9.el8.noarch
:: [ 11:50:52 ] :: [   PASS   ] :: Creating tmp directory (Expected 0, got 0)
:: [ 11:50:52 ] :: [   PASS   ] :: Command 'pushd /tmp/tmp.0vPt8NfVyz' (Expected 0, got 0)
:: [ 11:50:52 ] :: [   PASS   ] :: Adding the testing user (Expected 0, got 0)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 0s
::   Assertions: 4 good, 0 bad
::   RESULT: PASS (Setup)


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 11:50:53 ] :: [   PASS   ] :: Showing umask (Expected 0, got 0)
:: [ 11:50:53 ] :: [   PASS   ] :: root umask should be 0022 (Assert: '0022' should equal '0022')
:: [ 11:50:53 ] :: [   PASS   ] :: Showing umask for the testing user (Expected 0, got 0)
:: [ 11:50:53 ] :: [   PASS   ] :: user non-login umask should be 0022 (Assert: '0022' should equal '0022')
:: [ 11:50:53 ] :: [   PASS   ] :: Showing umask for the testing user in a login shell (Expected 0, got 0)
:: [ 11:50:53 ] :: [   PASS   ] :: user login umask should be 0002 (Assert: '0002' should equal '0002')
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 1s
::   Assertions: 6 good, 0 bad
::   RESULT: PASS (Test)


RHEL9:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Setup
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 11:47:25 ] :: [   PASS   ] :: Checking for the presence of setup rpm 
:: [ 11:47:25 ] :: [   LOG    ] :: Package versions:
:: [ 11:47:25 ] :: [   LOG    ] ::   setup-2.13.7-8.el9.noarch
:: [ 11:47:25 ] :: [   PASS   ] :: Creating tmp directory (Expected 0, got 0)
:: [ 11:47:25 ] :: [   PASS   ] :: Command 'pushd /tmp/tmp.QNWJiya44b' (Expected 0, got 0)
:: [ 11:47:25 ] :: [   PASS   ] :: Adding the testing user (Expected 0, got 0)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 0s
::   Assertions: 4 good, 0 bad
::   RESULT: PASS (Setup)


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 11:47:26 ] :: [   PASS   ] :: Showing umask (Expected 0, got 0)
:: [ 11:47:26 ] :: [   PASS   ] :: root umask should be 0022 (Assert: '0022' should equal '0022')
:: [ 11:47:26 ] :: [   PASS   ] :: Showing umask for the testing user (Expected 0, got 0)
:: [ 11:47:26 ] :: [   PASS   ] :: user non-login umask should be 0022 (Assert: '0022' should equal '0022')
:: [ 11:47:26 ] :: [   PASS   ] :: Showing umask for the testing user in a login shell (Expected 0, got 0)
:: [ 11:47:26 ] :: [   FAIL   ] :: user login umask should be 0002 (Assert: '0022' should equal '0002')
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 0s
::   Assertions: 5 good, 1 bad
::   RESULT: FAIL (Test)

(In reply to Karel Volný from comment #8)
> now I am confused ...
> 
> the bug description says the umask should be 0002
> 
> the fix is about dropping uid check and results in 0022 - which is a change
> from previous release
> 
> so ... setting 0002 is now considered incorrect?

Yes, umask for login shell is no longer set through /etc/profile, but /etc/login.defs, and its default value is 022 for everyone. If it needs to be changed, it should be done solely through that file. This change got from Fedora to RHEL9.0 due to bug 1722387 and is expected and longed for a very long time.

I should have likely closed this one as NOTABUG and created a new BZ instead of going forward and fixing it for non-login shells, but as 022 was made the default on RHEL9.0 we see complaints now about the discrepancy between login and non-login shells, e.g. here:

https://training-feedback.redhat.com/browse/RH124-744

and the included patch is just fixing this state.

I am sorry for the confusion.

ok, thanks for the clarification, so we can move on with this

Is there a reason why we're switching the default user umask from 002 to 022?  This breaks the idea in User Private Groups that files were automatically writable by a user and that user's private group (which was only that user) and that we could easily set up shared directories with setgid.  If we're going to go away from that in some way, Training is going to have to adjust our approach on that.  So we're interested in the logic behind this change beyond just "tightening up security".  Thanks!

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (setup bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2552