podman creates ~/.config with 700 but systemctl creates ~/.config with 755 file permissions

[eriksjolund]

I noticed a small difference between how podman and systemctl creates the directory ~/.config

On a Fedora 36 computer a newly created user account does not have the directory ~/.config but
the directory will be created when running podman run ... or
systemctl edit --user --force --full a.service. I noticed that the file permissions for ~/.config will
be different depending on which command that is being run.

command	~/.config file permissions
podman run --rm docker.io/library/alpine true	700
systemctl edit --user --force --full a.service	755

Example "podman run --rm docker.io/library/alpine true"

[root@asus ~]# useradd testuser1
[root@asus ~]# machinectl shell testuser1@
Connected to the local host. Press ^] three times within 1s to exit session.
[testuser1@asus ~]$ ls -ld .config
ls: cannot access '.config': No such file or directory
[testuser1@asus ~]$ podman run --rm docker.io/library/alpine true
Trying to pull docker.io/library/alpine:latest...
Getting image source signatures
Copying blob 213ec9aee27d done
Copying config 9c6f072447 done
Writing manifest to image destination
Storing signatures
[testuser1@asus ~]$ ls -ld .config
drwx------. 3 testuser1 testuser1 17 Sep 17 08:36 .config
[testuser1@asus ~]$

Example "systemctl edit --user --force --full a.service"

[root@asus ~]# useradd testuser2
[root@asus ~]# machinectl shell testuser2@
Connected to the local host. Press ^] three times within 1s to exit session.
[testuser2@asus ~]$ ls -ld .config
ls: cannot access '.config': No such file or directory
[testuser2@asus ~]$ systemctl edit --user --force --full a.service
[testuser2@asus ~]$ ls -ld .config
drwxr-xr-x. 3 testuser2 testuser2 21 Sep 17 08:38 .config
[testuser2@asus ~]$ ls -ld .config/systemd/user/
drwxr-xr-x. 2 testuser2 testuser2 23 Sep 17 08:40 .config/systemd/user/
[testuser2@asus ~]$ ls -ld .config/systemd/user/a.service
-rw-r--r--. 1 testuser2 testuser2 143 Sep 17 08:40 .config/systemd/user/a.service
[testuser2@asus ~]$

About the system

[root@asus ~]# cat /etc/fedora-release 
Fedora release 36 (Thirty Six)
[root@asus ~]# rpm -q podman
podman-4.2.0-2.fc36.x86_64
[root@asus ~]# rpm -q systemd
systemd-250.8-1.fc36.x86_64

Do you know why the file permissions for ~/.config are different?
(I guess the answer is that there is no standard for this and that podman and systemctl came to different conclusions about what is the best choice)

[rhatdan]

No, Just that we create it more locked down then systemd does. Systemd will allow the noon owner user to list and search through the directory path, while we block this. I would figure container/storage or whatever library actually creates the directory did not think about it.

I am not sure which of us is doing it correctly. Under what situation would different users on the system have to look at content of another users config directory?

[eriksjolund]

Under what situation would different users on the system have to look at content of another users config directory?

I don't have any idea.