Subject: Bug#3189: nvi over-cautious about .exrc?

From: [email-masked] (Bruce Perens)
Date: Mon, 3 Jun 96 08:44 PDT

From: Steve Greenland <[email-masked]>
> It would be possible to check if the owner and the group were the
> same, and allow mode 664 if that were the case. Is that sufficient,
> and is it worth doing? (What's the advantage of umask=002?)

You'd have to compare the string version, not the numeric UID and GID.
It sounds OK, though debian-specific.

	Bruce
--
Pixar's Toy Story: Over 1/3 Billion dollars world box office so far.

Bruce Perens AB6YM          [email-masked]            http://www.hams.com/

---

From: Marek Michalkiewicz <[email-masked]>
Date: Mon, 3 Jun 1996 21:51:36 +0200 (MET DST)

> It sounds OK, though debian-specific.

A better check would be that the only member of that group is the
user executing the editor.

Maybe we can just change /etc/adduser.conf so that USERGROUPS is off
by default?  I don't really see the point in enabling this feature
by default - I've seen no other unix system doing that.  The fewer
surprises for the new admin, the better...

Worse, the system won't let me change this setting before the first
user account is created, and I have to fix permissions later.  Maybe
I don't want to create any user accounts at all?  (For example, if
the system is a NIS client.)  The only thing done before running
dselect should be setting the root password (and maybe printing
a message that it is highly recommended to create a user account).

I know it is a good idea to create a new account so that I don't have
to do everything as root - but it should not be enforced this way.

Marek