I noted that in the source of mailman 2.1.7 there are 2 lines in bin/mailmanctl:
line 421-422 # Clear our file mode creation umask os.umask(0)
Is this intended? Is it the reason why data/bounce-events-?????.pck are world-writable?
There doesn't appear to be a good reason. This has been changed for Mailman 2.1.8 so that the 'default' umask will be 007 and also the specific creation of the bounce-events queue file will have no permission for 'other'.
The changes to bin/mailmanctl and Mailman/Queue/BounceRunner.py have been committed to CVS and can be seen (soon) at http://cvs.sourceforge.net/viewcvs.py/mailman/mailman/.