Dear Debian Documentation Team,

Trixie enables pam_umask usergroups by default, which changes the typical
umask from 0022 to 0002.

This was quite a surprise to me and is not documented in the Release Notes.

References:
  * libpam-modules.NEWS entry
https://salsa.debian.org/vorlon/pam/-/blob/master/debian/libpam-modules.NEWS?ref_type=heads#L19-33
  * #583958 - enable pam_umask usergroups by default
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583958
  * #1065806 - pam: recent upgrade changes previous default umask
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1065806
  * #1068674 - Document pam_umask change in release notes
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068674
  * Debate/umask
https://wiki.debian.org/Debate/umask

Could the libpam-modules.NEWS entry above be inserted into the
"What's new in the distribution section"?
https://www.debian.org/releases/trixie/release-notes/whats-new.en.html#what-s-new-in-the-distribution

Thank you!
Daniel Lewart
Urbana, Illinois

Hi,

Found this by chance after about twenty Trixie upgrades.

This umask change is mentioned in the current wiki
(https://wiki.debian.org/UserPrivateGroups and
https://wiki.debian.org/Permissions#System-wide_umask_configuration) but
not in Trixie release notes. This is a breaking change in term of
default permission and security and should be advertised in the release
note, maybe even into the "Issues to be aware of for trixie" section of
the release notes as it changes a default behaviour without any user
interaction.

Regards,

Perhaps someone could suggest some text -- i suggest answering the following:

* what is the new default umask in trixie
 -- if this is different for new/upgraded systems say what these are
 -- if there are differences for login via console/ssh say what they are
* what was the default in bookworm
* what are the main consequences
* what file(s) should be edited to change the default
* link to some generic explanation of terms like umask, usergroups,
permissions (the wiki has some of this)


none of this seems to be documented anywhere in simple terms, as far
as i can find

als /etc/skel/.profile wrongly claims a default of 022 is set in
/etc/profile -- nothing is in /etc/profile or /etc/login.defs any more

neither umask(2) not pam_umask(8) say what the default is, and
https://www.debian.org/doc/debian-policy/search.html?q=umask has
nothing to say

https://wiki.debian.org/Debate/umask suggests it is complicated, but
doesnt give a clear explanation

/usr/share/doc/libpam-modules/NEWS.Debian.gz has something about
usergroups but it's not very informative

Perhaps someone could suggest some text -- i suggest answering the following:

* what is the new default umask in trixie
 -- if this is different for new/upgraded systems say what these are
 -- if there are differences for login via console/ssh say what they are
* what was the default in bookworm
* what are the main consequences
* what file(s) should be edited to change the default
* link to some generic explanation of terms like umask, usergroups,
permissions (the wiki has some of this)


none of this seems to be documented anywhere in simple terms, as far
as i can find

als /etc/skel/.profile wrongly claims a default of 022 is set in
/etc/profile -- nothing is in /etc/profile or /etc/login.defs any more

neither umask(2) not pam_umask(8) say what the default is, and
https://www.debian.org/doc/debian-policy/search.html?q=umask has
nothing to say

https://wiki.debian.org/Debate/umask suggests it is complicated, but
doesnt give a clear explanation

/usr/share/doc/libpam-modules/NEWS.Debian.gz has something about
usergroups but it's not very informative

That file however answers a lot of the following questions. Let me
copy it here:

|    Starting with PAM version 1.5.3, Debian supports usergroups for default
|    umask of users logging in.  If the primary group name of a user
|    matches their primary user name (user pat's default group is also
|    called pat), then files will be group writable by default. To disable
|    this use a group name that differs from the user name or add
|    nousergroups to the pam_umask line in
|    /etc/pam.d/common-session and
|    /etc/pam.d/common-session-noninteractive:
|
|    session optional            pam_umask.so nousergroups
|
|
| -- Sam Hartman <hartmans@debian.org>  Mon, 08 Apr 2024 16:15:58 -0600

This is not answered directly, but the advice for disabling is to
edit both common-session and common-session-noninteractive, so one
can reasonable assume it applies to all PAM sessions. If you have a
session that is not managed by PAM, you are on your own anyway.

For the actual default, per the explanation it depends on your
primary group name.

Unclear. The default in bookworm depended on different things, IIRC.

See above:

|                                If the primary group name of a user
|    matches their primary user name (user pat's default group is also
|    called pat), then files will be group writable by default.

See above:

|                                                               To disable
|    this use a group name that differs from the user name or add
|    nousergroups to the pam_umask line in
|    /etc/pam.d/common-session and
|    /etc/pam.d/common-session-noninteractive:
|
|    session optional            pam_umask.so nousergroups


C.