World‑readable .aux and .log files after TeX compilation

Question

After a TeX run with the default settings, the auxiliary files .aux and .log are created with the process’s umask. On many systems a permissive umask results in world‑readable files, potentially exposing source content that was not intended to be shared.
The goal is to decide whether TeX should alter its file‑creation routine to enforce more restrictive permissions for these files, independent of the invoking umask, in order to reduce the chance of accidental disclosure.
This change must be weighed against existing workflows that rely on group or world readability (e.g., shared build directories, log‑processing scripts) and against the principle of honoring the user’s umask. The effect may differ between pdftex, XeTeX, LuaTeX and across TeX Live releases.
Should TeX internally set a more restrictive mode (e.g., 0600) for .aux and .log files when the umask allows broader access? Would an explicit option to control auxiliary‑file permissions be preferable to changing the default? How would a stricter default impact documents built in shared or automated environments?

Tasadduq Burney · Answer

Answer
TeX should not silently override the invoking umask for .aux and .log files. A safer path is an explicit, opt-in mechanism—such as a command-line flag or configuration variable—that lets users request a stricter mode when they need it.
Confirmed behavior

pdftex, XeTeX, and LuaTeX create auxiliary files with the standard C library open call, so the mode is 0666 & ~umask.
Recent TeX Live releases provide no built-in switch, environment variable, or configuration file to force a fixed mode on these files.
When the umask is permissive (for example 0022 or 0002), the resulting files become world-readable, which can expose source content unintentionally.
Shared build directories, log-processing scripts, and CI pipelines often depend on group or world readability of these files.

Verify on your system

Print the current umask: umask
Run a minimal job, e.g. pdftex test.tex where test.tex contains a simple \bye.
Inspect the created files: ls -l test.aux test.log
Compare the observed mode with 0666 & ~umask. If they match, the umask-driven behavior is confirmed.

Recommendation
Prefer an explicit option, for example -aux-mode=0600, over changing the default. Keeping the default unchanged preserves compatibility with existing workflows while giving security-conscious users a supported way to tighten permissions.
Missing detail
If your build or logging pipeline requires other users to read these files, please confirm that requirement. Knowing whether shared access is essential determines whether a group-only mode would be a better default than owner-only.

World‑readable .aux and .log files after TeX compilation

1 answer

Answer

Confirmed behavior

Verify on your system

Recommendation

Missing detail

Your perspective belongs here.

0 question comments