A few days ago, I was trying gamin under NetBSD which unfortunately didn't work at all. The first problem I encountered was that it complained about the excessive permissions given to newly created local sockets (those stored in the file-system, also known as "Unix sockets" historically). After analyzing the issue, I saw that those files were given 777 permissions, regardless of the user's umask. Strangely, the code was explicitly checking for this mode after creation, so I was probably missing something.
I wrote a little test program that creates a local socket and ran it under Linux, FreeBSD and OpenBSD. All of them correctly respected the user's umask (setting the permissions to 755). So, what was going on with NetBSD?
After asking in the tech-kern@ mailing list, I was told the following: the traditional Unix behavior when creating local sockets was to give them 777 permissions to mimic real sockets (i.e., everybody can connect to them). Therefore, the portable way to create them in a secure way is to first make a directory with safe permissions (say, 700) and then create the socket inside it.
However, I'm thinking about changing NetBSD to honor the user's mask in this case too (it's a trivial fix). It does not hurt in any way and it may improve portability of some "non-portable" programs. (Though, this will hide portability bugs in some programs, which makes me dubious about the change...)
By the way, gamin was doing the right thing (creating sockets inside secure directories) so I don't know why it wanted to ensure that the sockets were "safe".
