GNU bug report logs - #51442
Non-default umask when using guix system leads to wrong file permissions

Previous Next

Full log

Message #10 received at 51442 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Josselin Poiret <dev <at> jpoiret.xyz>
Cc: 51442 <at> debbugs.gnu.org
Subject: Re: bug#51442: Non-default umask when using guix system leads to
 wrong file permissions
Date: Fri, 29 Oct 2021 21:10:52 +0200

[Message part 1 (text/plain, inline)]

Hi,

Josselin Poiret <dev <at> jpoiret.xyz> skribis:

> As reported on IRC by wonko
> (https://logs.guix.gnu.org/guix/2021-10-27.log#115445),

wonko mentions files in /etc (those are created by the activation
snippets).

> when running ‘guix system’ under a different umask, some files are
> created with the wrong permissions.  This can happen because ‘sudo’
> does by default keeps the umask it is running on (by ORing it with the
> default one, often 022).
>
> I'm not sure what would be the best way to go about this, I suggest
> checking if umask == #o022, and if not, print a warning and set it to
> #o022, and only in ‘guix system’.

Perhaps the best fix would be to set the umask explicitly before
activation snippets run, like so (untested):

[Message part 2 (text/x-patch, inline)]

diff --git a/gnu/services.scm b/gnu/services.scm
index 1655218f2d..b79436d3f3 100644
--- a/gnu/services.scm
+++ b/gnu/services.scm
@@ -617,6 +617,10 @@ (define actions
                       (use-modules (gnu build activation)
                                    (guix build utils))
 
+                      ;; Set the correct umask so files are created with the
+                      ;; expected permissions.
+                      (umask #o022)
+
                       ;; Make sure the user accounting database exists.  If it
                       ;; does not exist, 'setutxent' does not create it and
                       ;; thus there is no accounting at all.

[Message part 3 (text/plain, inline)]

WDYT?

Thanks,
Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.