On Sun, May 16, 2010 at 01:24:31PM +0200, Andreas Metzler wrote: > On 2010-05-15 Andreas Hemel <[email protected]> wrote: > > Package: exim4 > > Version: 4.71-4 > > Severity: normal > > > According to bug #581434 the default umask on new installations will > > change from 022 to 002. Debian uses user private groups, meaning every > > user is in his own private group, that nobody else is a member of. > > Hello, > This is not entirely correct. Debian uses user private groups *by* > *default* but can also be set differently. Just take a look at the > .debian.org machines, they do not use UPGs (except for alioth): > > ametz...@merkel:~$ getent passwd ametzler > ametzler:x:2571:800:Andreas Metzler,,,,:/home/ametzler:/bin/bash > ametz...@merkel:~$ getent group 800 > Debian:x:800:cvs_boot > ametz...@merkel:~$ groups > Debian
I'm not a DD, so I don't have access to those machines. The possibility to disable UPG is not directly relevant to the point I was trying to make here. I'm simply arguing that something like the following should work on a Debian system by default: $ echo "[email protected]" > ~/.forward Currently, if the umask defaults to 002, this will prevent mail delivery and the user is in no way notified that there is a problem. > I could set > > modemask = 002 > > on the userforward router and make it overrideable by macro. Since we > already set check_local_user the modemask setting switches on > check_group. Exim will require that the .forward file is owned by the > users primary group. (This could introduce breakage on upgrades if > .forward is 0600 but owned by a different group delivery will break. IMHO the ideal solution would be to determine the applicable modemask based on whether the group owning the .forward is the private group of the user. That is, the user is the only member and the group name is identical to the user name. I realize this is probably not possible without patching exim, so I'm, for my part, happy with the solution you outlined above. Andreas -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
