Re: [rfc] change default setuid permissions from 4755 to 4711

Quoting Mike Frysinger ([email protected]):
> we've been patching the permissions in shadow for a while now from 4755 to 
> 4711 ... i dont think anyone here has asked the shadow maintainers, so i'm 
> doing so now :)
> 
> there's no need to grant read permissions for setuid binaries, so 4711 is just 
> as functional as 4755, while keeping internal binary information (such as 
> function addresses) hidden

((one of the) Debian package maintainers speaking)

I'm sad to see that this discussion turned into a kind of
flamewar. Even if one does not agree with Mike's suggestion, there is
IMHO no need to throw it away the way it was. Typical email
misunderstanding, I'm afraid, and very common in mailing list because
people never pay enough attention to not hurt other people's feelings.

That said, I think that such general system design choices should be
left to distros designers and should not make it into upstream
sources. In short, if we, in Debian, decide to implement Mike's
proposal (which we won't, this would be against Debian policy), this
would be made in the package build scripts, not by requesting the
change in upstream sources, which should be kept as "standard" as
possible (and I guess everyone will agree that non readable binaries
are not really common in Unix systems).

> +suidbinperms   = 4711
> +suidubinperms  = 4711

.../...

> -		chmod -f 4755 $(DESTDIR)$(bindir)/$$i; \
> +		chmod -f $(suidbinperms) $(DESTDIR)$(bindir)/$$i; \
>  	done
>  	for i in $(suidubins); do \
> -		chmod -f 4755 $(DESTDIR)$(ubindir)/$$i; \
> +		chmod -f $(suidubinperms) $(DESTDIR)$(ubindir)/$$i; \


And, in any case, using a "suidbinperms" variable in the Makefile
seems to be an interesting suggestion, even if its value is kept to
4755...:-)