On Mon, Aug 2, 2021 at 10:50 AM Thorsten Kukuk
On Mon, Aug 02, Mathias Homann wrote:
Am Sonntag, 1. August 2021, 15:15:20 CEST schrieb Giuseppe Fierro:
I've returned to OpenSUSE after years and it was quite shocking to see the weird permissions for user's home directory.
How about switching to "user private groups" the way red hat does it?
For system accounts we do this even today already.
So only a little step to do it for normal users, too.
it's a two fold thing:
1. each user has a dedicated primary group with the same name as their username 2. default permissions are 640 for regular data, use 0600 for sensitive stuff and home directories.
then, to give user fred read access to toms files: "usermod -aG tom fred"
So people either need admin access to usermod or they always need to look for an admin if you want to exchange files with one other person. I'm pretty sure the result will be that most people will use "644" then.
The private group was not about accessing other user's files. It allowed using group permissions to control access to shared project data. Because each user is in a private group, you can set umask to allow (full) group access by default; then you create a project directory with SGID bit and owned by the project group and assign users to this project group. So files created in this directory inherit this group and users in this project group have access.
I don't care if we have a shared users group or "private" groups, from a security perspective, the result is similar if people don't care about their permissions.
Different models are better suited for different workflows. Neither is inherently more secure than the other.
But to argument with "security" is the wrong road, because this will not increase "security" by a single jota.