xterm started as application session on the remote server runs with umask 0000. This has security impact as files/directories created by users are then world-writable. Expected: some sensible default like 002 or 022.

Version: winswitch 0.12.23-1, xpra 2.1.1-r16658-1

Possible cause: winswitch server assumes umask will be set in /etc/bashrc. That is true on Red Hat derived systems. But it is not true on Ubuntu (tested 16.04 LTS) where I think umask is expected to be set by PAM session (pam_umask.so).

Perhaps related, the PAM file provided by /etc/pam.d/xpra seems to assume a Red Hat style system and most of the PAM modules referenced there do not exist on a Ubuntu system.

The winswitch repo for centos/redhat based distros doesn't seem to contain the actual winswitch RPM

root /etc/yum.repos.d # cat winswitch.repo
[winswitch]
name=Winswitch
enabled=1
metadata_expire=1d
gpgcheck=1
gpgkey=http://winswitch.org/gpg.asc
baseurl=http://winswitch.org/dists/CentOS/7/x86_64/
root /etc/yum.repos.d # yum install winswitch
Loaded plugins: fastestmirror, langpacks, ps
Repository winswitch is listed more than once in the configuration
Loading mirror speeds from cached hostfile
 * elrepo: repos.ord.lax-noc.com
 * elrepo-kernel: repos.ord.lax-noc.com
 * epel: mirror.steadfast.net
 * nux-dextop: mirror.li.nux.ro
 * ovirt-4.1: mirrors.rit.edu
 * ovirt-4.1-epel: mirror.steadfast.net
No package winswitch available.
Error: Nothing to do
root /etc/yum.repos.d #

For software installed from source, it is essential to be able to specify the installation directory tree (eg /usr/local) in order to avoid conflicts with OS installed software from packages.

And for those of us that manage installed local software with GNU stow,

(see ​https://www.gnu.org/software/stow if not familiar with the approach)

it is even more important that files get installed under the specified directory tree.

Now winswitch does this for most of the install if --prefix is used

/usr/bin/python "/usr/src/build/winswitch-0.12.23/setup.py" install --prefix="/usr/local/stow/Network/winswitch-0.12.23/usr/local"

creating /usr/local/stow/Network/winswitch-0.12.23/usr/local/lib/python2.7/site-packages/winswitch
creating /usr/local/stow/Network/winswitch-0.12.23/usr/local/lib/python2.7/site-packages/winswitch/ui
copying build/lib.linux-i686-2.7/winswitch/ui/window_fake_tray.py -> /usr/local/stow/Network/winswitch-0.12.23/usr/local/lib/python2.7/site-packages/winswitch/ui
...
byte-compiling /usr/local/stow/Network/winswitch-0.12.23/usr/local/lib/python2.7/site-packages/winswitch/ui/window_fake_tray.py to window_fake_tray.pyc
...

but for a number of items the install process ignores the prefix and installs directly under system directories /etc and /usr/lib

creating /etc/winswitch

and

creating /usr/lib/winswitch

For installs under "/usr/local" these should instead be accessible under /usr/local/etc/winswitch and /usr/local/lib/winswitch respectively when installation is complete.

Now after checking the setup.py file, it seems a non-standard (?) method of specifying the destination for installs works, by specifying the environmental variable PREFIX="prefix_dir" get the etc/winswich and lib/winswitch installed under the prefix dir BUT --prefix prefix_dir is still needed to get all the other items to the prefix directory.

Please ensure that the --prefix prefix_dir variable is applied to all items being installed without the need for adding the environmental variable, or at the very minimum, mention this double requirement in the README file.

Thank you for your assistance in resolving this issue.