Why are the Documents, Desktop, etc. directories not group-writable by default?

Question

If I create new files and directories in my home directory, these are group writable by default:

will@together:~$ touch test
will@together:~$ mkdir test_dir
will@together:~$ ll | grep test
-rw-rw-r--  1 will will         0 Apr 23 10:36 test
drwxrwxr-x  2 will will      4096 Apr 23 10:36 test_dir/

The reason for this behavior is due to the Debian/Ubuntu way of handling users and groups, called User Private Groups.

I just did a fresh install of Ubuntu and I noticed that the automatically created directories (Documents, Desktop, etc.) are not group writable.

will@together:~$ ll | grep Documents
drwxr-xr-x  2 will will      4096 Apr 22 22:21 Documents/

I was just wondering what the reason for this is.

Answer 1

First, you can ll -d Documents, and save grep for when it's needed.

In /etc/adduser.conf one finds:

# If DIR_MODE is set, directories will be created with the specified
# mode. Otherwise the default mode 0755 will be used.
DIR_MODE=0751

See man adduser and man adduser.conf.

Answer 2

This is because in /etc/login.defs the default umask is set to 022 when your home directory is created. 022 is the "historical" umask that existed before the idea of private groups emerged. But USERGROUPS_ENAB yes in /etc/login.defs changes it to 002 (for anything created after your home directory is created).

Configurations in /etc/adduser.conf will override the one mentioned above only if private groups are disabled. The motivation to move to 002 is that with the emergence of private groups, 022 became very restrictive for eg: to set up shared directories.

You can see more information on this in the Lauchpad and Debian bug log. In addition, from /etc/login.defs:

> # UMASK is the default umask value for pam_umask and is used by
> # useradd and newusers to set the mode of the new home directories.
> # 022 is the "historical" value in Debian for UMASK
> # 027, or even 077, could be considered better for privacy
> # There is no One True Answer here : each sysadmin must make up his/her
> # mind.
> #
> # If USERGROUPS_ENAB is set to "yes", that will modify this UMASK default value
> # for private user groups, i. e. the uid is the same as gid, and username is
> # the same as the primary group name: for these, the user permissions will be
> # used as group permissions, e. g. 022 will become 002.

# Enable setting of the umask group bits to be the same as owner bits
# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
# the same as gid, and username is the same as the primary group name.
#
# If set to yes, userdel will remove the user´s group if it contains no
# more members, and useradd will create by default a group with the name
# of the user.
#
USERGROUPS_ENAB yes