On lun, 2009-05-04 at 10:23 +0200, Thomas Constans wrote: > Package: thunar > Version: 1.0.1-1 > Severity: grave > Tags: security > Justification: user security hole > > > A new directory, created from Thunar, will have permission 777, > bypassing umask value.
That's wrong, but I think you're bitten by the “daemon” status of Thunar. Can you try to: - quit thunar (thunar -q) - check that no thunar instance is running (ps aux | grep -i thunar) - set the umask from your terminal (umask 077) - run thunar (thunar) - create a folder - check the permissions Here, it works perfectly fine, could you try? I guess Thunar is run (from the session) before you set the umask. Then if you run thunar from a terminal, after setting a umask, no new process is created, it uses the already running one, so you don't have the correct umask. What you need is to set the umask before thunar is run, so it might be a good idea to set it in .xsessionrc or in your initscript so all the desktop benefits from it. (or you can create a wrapper for thunar if you only want thunar to use it) Cheers, -- Yves-Alexis
signature.asc
Description: This is a digitally signed message part
