umask for borgmatic itself #189

New Issue

Closed

opened 2019-06-13 00:09:57 +00:00 by Juerd · 6 comments

Juerd commented 2019-06-13 00:09:57 +00:00

Copy Link

Borgmatic lets you set a umask for borg create, but it would be nice to allow setting an umask for the hooks as well, or maybe for the entire borgmatic process.

Of course it's already possible by specifying a umask in the script itself, but that is easily forgotten and has to be repeated for each task.

I'm currently using something like:

hooks:
    before_backup:
        - umask 077; mysqldump --all-databases > /var/lib/mysql-backup.sql

But would like to be able to leave out the umask call, and have 077 be the default that can be overridden. Perhaps:

#hooks:
    # Umask to be used for hooks
    #umask: 0077

    # ...
    #before_backup:
    #    - ...

Especially because many novice system administrators probably only know chmod and are likely to introduce race conditions, I think it would be advisable for borgmatic to use a strict umask such as 077 by default.

Borgmatic lets you set a umask for `borg create`, but it would be nice to allow setting an umask for the hooks as well, or maybe for the entire borgmatic process. Of course it's already possible by specifying a umask in the script itself, but that is easily forgotten and has to be repeated for each task. I'm currently using something like: hooks: before_backup: - umask 077; mysqldump --all-databases > /var/lib/mysql-backup.sql But would like to be able to leave out the umask call, and have 077 be the default that can be overridden. Perhaps: #hooks: # Umask to be used for hooks #umask: 0077 # ... #before_backup: # - ... Especially because many novice system administrators probably only know `chmod` and are likely to introduce race conditions, I think it would be advisable for borgmatic to use a strict umask such as 077 by default.

witten commented 2019-06-13 00:12:03 +00:00

Owner

Copy Link

Makes sense, thanks for filing! Can you think of anything off-hand that would benefit from this sort of umask other than borgmatic hooks?

Makes sense, thanks for filing! Can you think of anything off-hand that would benefit from this sort of umask other than borgmatic hooks?

Juerd commented 2019-06-13 00:21:32 +00:00

Author

Copy Link

Not currently, but by umask'ing the whole thing does protect against future data leaks whenever new features in borg or borgmatic result in new files being written with broad permissions. Of course, that hypothetical future behaviour could either be a bug or a feature, so it could just as well break the backups. This is mostly philosophical: err on the side of data secrecy or data redundancy :)

Not currently, but by umask'ing the whole thing does protect against future data leaks whenever new features in borg or borgmatic result in new files being written with broad permissions. Of course, that hypothetical future behaviour could either be a bug or a feature, so it could just as well break the backups. This is mostly philosophical: err on the side of data secrecy or data redundancy :)

witten commented 2019-06-13 00:25:22 +00:00

Owner

Copy Link

Yup, understood. The reason I ask is because: 1. If it's in the hooks section of config as per your example, it should probably only apply to hooks, and 2. I'm not sure how to apply a umask to the whole borgmatic process such that it also applies to subprocesses. Maybe os.umask() just works for that?

Yup, understood. The reason I ask is because: 1. If it's in the hooks section of config as per your example, it should probably only apply to hooks, and 2. I'm not sure how to apply a umask to the whole borgmatic process such that it also applies to subprocesses. Maybe `os.umask()` just works for that?

Juerd commented 2019-06-13 00:39:03 +00:00

Author

Copy Link

Child processes will inherit the umask from the parent process.

Honestly I don't know if it's better to set a umask for the entire thing, or just for the hooks. I'd be happy with either!

Child processes will inherit the umask from the parent process. Honestly I don't know if it's better to set a umask for the entire thing, or just for the hooks. I'd be happy with either!

witten referenced this issue from a commit 2019-06-14 00:05:52 +00:00

Set umask used when executing hooks via "umask" option in borgmatic hooks section (#189).

witten commented 2019-06-14 00:07:00 +00:00

Owner

Copy Link

This is done and implemented in master. I'll follow up here when it's released (soon!). I went with the hooks section "umask", as that seemed less likely to have unintended impacts / interactions (for instance with Borg's own umask). Thanks for the suggestion!

This is done and implemented in master. I'll follow up here when it's released (soon!). I went with the hooks section "umask", as that seemed less likely to have unintended impacts / interactions (for instance with Borg's own umask). Thanks for the suggestion!

witten closed this issue 2019-06-14 00:07:00 +00:00

witten commented 2019-06-14 05:07:04 +00:00

Owner

Copy Link

Just released as part of borgmatic 1.3.6. Enjoy!

Just released as part of borgmatic 1.3.6. Enjoy!

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

spot-check

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

1.7.7

1.7.6

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.6.6

1.6.5

1.6.4

1.6.3

1.6.2

1.6.1

1.6.0

1.5.24

1.5.23

1.5.22

1.5.21

1.5.20

1.5.19

1.5.18

1.5.17

1.5.16

1.5.15

1.5.14

1.5.13

1.5.12

1.5.11

1.5.10

1.5.9

1.5.8

1.5.7

1.5.7.dev0

1.5.6

1.5.5

1.5.4

1.5.3

1.5.2

1.5.1

1.5.0

1.4.22

1.4.21

1.4.20

1.4.19

1.4.18

1.4.17

1.4.16

1.4.15

1.4.14

1.4.13

1.4.12

1.4.11

1.4.10

1.4.9

1.4.8

1.4.7

1.4.6

1.4.5

1.4.4

1.4.3

1.4.2

1.4.1

1.4.0

1.3.26

1.3.25

1.3.24

1.3.23

1.3.22

1.3.21

1.3.20

1.3.19

1.3.18

1.3.17

1.3.16

1.3.15

1.3.14

1.3.13

1.3.12

1.3.11

1.3.10

1.3.9

1.3.8

1.3.7

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3.1

1.3.0

1.2.18

1.2.17

1.2.16

1.2.15

1.2.14

1.2.13

1.2.12

1.2.11

1.2.10

1.2.9

1.2.8

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2.1

1.2.0

1.1.15

1.1.14

1.1.13

1.1.12

1.1.11

1.1.10

1.1.9

1.1.7

1.1.6

1.1.5

1.1.4

1.1.3

1.1.2

1.1.1

1.1.0

1.0.3

1.0.2

1.0.1

1.0.0

0.1.8

0.1.7

0.1.6

0.1.5

0.1.4

0.1.3

0.1.2

0.1.1

0.1.0

0.0.7

0.0.6

0.0.5

0.0.4

0.0.3

0.0.2

Labels

Clear labels   

bug

  

data loss

  

design finalized

  

good first issue

  

new feature area

  

question / support

  

security

  

waiting for response

No Label

bug

data loss

design finalized

good first issue

new feature area

question / support

security

waiting for response

Milestone

Clear milestone

No items

No Milestone

Assignees

Clear assignees

No Assignees

2 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: borgmatic-collective/borgmatic#189

No description provided.