When decrypting a file, GnuPG does not copy over the original file mode:
anarcat@curie:~$ echo foo > foo
anarcat@curie:~$ chmod 600 foo
anarcat@curie:~$ gpg -e -r anarcat@debian.org foo
anarcat@curie:~$ ls -l foo*
-rw------- 1 anarcat anarcat 4 fév 6 13:03 foo
-rw-r--r-- 1 anarcat anarcat 594 fév 6 13:04 foo.gpg
This can lead to involuntary content disclosure. For example, I had this in my
Git configuration:
[diff "gpg"]
textconv = gpg --batch --keyid-format long --verbose
(relation to T2942 should be noted here)
With the above configuration, "git log -p -1" will make git create a temporary
file in /tmp/XXXX_foo.gpg (properly unreadable) and pass it to gpg, which will
decrypt it, and create a publicly readable copy of the cleartext content of the
private file.
Encryption is not affected, oddly enough.
I would suggest that decryption operations should always happen with a 077
umask, or at least 007. At the very least, original file permissions should be
preserved.