bug#51442: Non-default umask when using guix system leads to wrong file permissions

[Ludovic Courtès]

Hi,

Josselin Poiret <dev@jpoiret.xyz> skribis:

> As reported on IRC by wonko
> (https://logs.guix.gnu.org/guix/2021-10-27.log#115445),

wonko mentions files in /etc (those are created by the activation
snippets).

> when running ‘guix system’ under a different umask, some files are
> created with the wrong permissions.  This can happen because ‘sudo’
> does by default keeps the umask it is running on (by ORing it with the
> default one, often 022).
>
> I'm not sure what would be the best way to go about this, I suggest
> checking if umask == #o022, and if not, print a warning and set it to
> #o022, and only in ‘guix system’.

Perhaps the best fix would be to set the umask explicitly before
activation snippets run, like so (untested):

diff --git a/gnu/services.scm b/gnu/services.scm
index 1655218f2d..b79436d3f3 100644
--- a/gnu/services.scm
+++ b/gnu/services.scm
@@ -617,6 +617,10 @@ (define actions
                       (use-modules (gnu build activation)
                                    (guix build utils))
 
+                      ;; Set the correct umask so files are created with the
+                      ;; expected permissions.
+                      (umask #o022)
+
                       ;; Make sure the user accounting database exists.  If it
                       ;; does not exist, 'setutxent' does not create it and
                       ;; thus there is no accounting at all.

WDYT?

Thanks,
Ludo’.