Hot answers tagged

58

If at all possible, use access control lists (ACL). Under Linux, make sure that the filesystem you're using supports ACLs (most unix filesystems do). You may need to change the mount options to enable ACLs: with ext2/ext3/ext4, you need to specify the acl mount option explicitly, so the entry in /etc/fstab should look like /dev/sda1 / ext4 errors=remount-...


54

You can control the assigned permission bits with umask, and the group by making the directory setgid to G. $ umask 002 # allow group write; everyone must do this $ chgrp G . # set directory group to G $ chmod g+s . # files created in directory will be in group G Note that you have to do the chgrp/chmod for every ...


14

This question is a good fit for linux acl. Since you don't state your OS, I'll assume Linux in what follows. Here is an example session. I don't know of a really good acl tutorial, but you could do worse than http://www.vanemery.com/Linux/ACL/linux-acl.html Note that the default acl behaves like a local umask. Since at least in Linux, umasks are applied ...


14

umask is subtractive, not prescriptive: permission bits set in umask are removed by default from modes specified by programs, but umask can't add permission bits. touch specifies mode 666 by default (the link is to the GNU implementation, but others behave in the same way; this is specified by POSIX), so the resulting file ends up with that masked by the ...


10

022 makes things convenient. 077 makes things less convenient, but depending on the circumstances and usage profile, it might not be any less convenient than having to use sudo. I would argue that, like sudo, the actual, measurable security benefit you gain from this is negligible compared to the level of pain you inflict on yourself and your users. As a ...


8

Start a subshell: (umask 22 && cmd) Then the new umask will only alter that subshell. Note that zsh executes the last command of the subshell in the subshell process instead of forking another one, which means that if that command is external, you're not even wasting a process, it's just that the fork is done earlier (so the umask is done in the ...


8

Most programs create files without the execute bits set (0666 == -rw-rw-rw-). Execute bits are pretty much only set by the compiler, during installation of an executable, or manually by the user. Then the umask is applied, to determine the actual permissions. create 0666 rw-rw-rw- umask 0222 r-xr-xr-x effective 0444 r--r--r-- Note that it's not ...


7

There are three normal ways to set a user's umask. Set UMASK in /etc/login.defs Add pam_umask.so to your PAM configuration in /etc/pam.d Set it in the shell startup files, e.g. /etc/profile There is no difference between system users and normal users in this regard. But I'm assuming you're trying to start a daemon with a custom umask? The problem is: ...


7

Assume the default mask of 0666. umask 0022 would make the new mask 0644 (0666-0022=0644) meaning that group and others have read (no write or execute) permissions. The "extra" digit (the first number = 0), specifies that there are no special modes. If mode begins with a digit it will be interpreted as octal otherwise its meant to be symbolic. 0 is a ...


5

For directories, what may work for you is using Extended ACLs and the masks, if you're on Linux. You can have a separate umask for each user by putting the umask xxx command into their ~/.profile.


5

Unix permissions don't apply to and can't be mapped to Windows permissions, so chmod is necessarily a no-op. (FAT doesn't have permissions at that granularity, and NTFS permissions are stored not by username or numeric ID but by a UUID that Linux has no access to.) The permissions you see are manufactured by the umask=002 part of the mount options.


5

The umask, in the way you mean it, is a property of the login shell. It is set in .profile or one of its relatives. Since scp doesn't log in interactively, it doesn't run any of these scripts, so it doesn't get the umask setting you've defined there. The closest thing I can think of to what you want is to set the permissions appropriately on the file ...


5

With the umask command... dennis@lightning:~$ umask 0002


5

If you only create directories with the mkdir command at the shell prompt, you could have: umask 7 mkdir() (umask 2 && command mkdir "$@") In your shell customisation file (~/.zshrc for zsh, ~/.bashrc for bash...). That is set the umask to 7, but redefine mkdir to a function where the real mkdir is called (with the same arguments ("$@")) with a ...


5

This is not possible. umask only prevents permissions but never adds them. Thus you get execute permission only if the creating open() syscall does contain them. This is the case if a compiler creates an executable file.


4

umask doesn't enforce rights, it forbids them. Have a look at strace: file: open("newfile", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3 directory: mkdir("newdir", 0777) = 0 touch doesn't ask for execution rights for a file (which wouldn't make sense).


4

The shell uses 0666 for the default permissions when creating a new file. As umask only removes permissions, never adds them, that is what the resultant file will have.


4

As @terdon stated in his comment, .bashrc is relevant only for users using bash. This is because the file is sourced when bash is launched. To achieve what you want to do, the easiest solution is to add the option -u to the line that reads something like Subsystem sftp /usr/lib64/misc/sftp-server in /etc/ssh/sshd_config. For example : Subsystem sftp ...


4

I believe this stems from 2 idea's, though I could be wrong. Initially in unix development permissions were wide open. Before the age of security, the idea of making a file only readable/writable/executable by certain individuals wasn't necessary. As such the natural progression from that stand point would be to take the idea of permissions, and restrict ...


3

The manpage for init describes the contents of /etc/default/init, and says: CMASK The mask (see umask(1)) that init uses and that every process inherits from the init process. If not set, init uses the mask it inherits from the kernel. Note that init always attempts to apply a umask of 022 before creating ...


3

cd doesn't change the umask. Either you've overloaded cd, or you have a pre- or post-command hook. Check that cd hasn't been overloaded by running type cd. This will show you whether it's a “shell builtin” (good) or an alias or function (suspicious). Run echo "$PROMPT_COMMAND" to see if you have a post-command hook (bash evaluates the value of this ...


3

Answering the question in your subject: OpenSuSE uses the traditional Unix umask setting, instead of the Debian-inspired one adopted by some other Linux distributions. Editing /etc/login.defs should be sufficient to change it; this will not affect users currently logged in, nor is there any way for you to force such a change to programs that are currently ...


3

The umask 022 (or 0022) is the commonly used umask for UNIX systems which use the traditional style of user account management. In the traditional style of account management, when a user is created, the user is given a default group which would be something like a team or department, or maybe as simple as "users". setgid directories (we could call them "...


3

I don't know if it's proper to answer my own question. Editors, please, advise on this if this is not the case. Thanks in advance. I think I've solved this mystery: the problem was the lack of a default ACL on the XFS volumes. Here's the ACL entry for /srv/backups, one of the directories affected: # file: srv/backups # owner: root # group: root user::rwx ...


3

vfat and ntfs filesystem don't contain any information to represent your unix file permissions. It will not be possible to set some specific permissions to the files and keep them. It is possible to set the initial permissions to a specific value and use this also for the creation of new files. This is called umask and supported by the mount command. You ...


3

You can check using : for user in $(awk -F: '{print $1}' /etc/passwd); do printf "%-10s" "$user" ; su -c 'umask' -l $user 2>/dev/null done To avoid checking system user do : for user in $(awk -F: '( $3 >= 500 ){print $1}' /etc/passwd); do printf "%-10s" "$user" ; su -c 'umask' -l $user 2>/dev/null done OutPut: ram 0022 shyam ...


3

The umask is typically set system wide through the config file: /etc/login.defs: $ grep UMASK /etc/login.defs UMASK 077 This value can be overridden but typically is not through either /etc/bashrc, /etc/profile and/or by the users in their $HOME/.bashrc (Assuming they're using Bash). If you grep for "umask" in those aforementioned files you'll ...


3

From man bash, in the INVOCATION section: When bash is invoked as an interactive login shell, or as a non-inter‐ active shell with the --login option, it first reads and executes com‐ mands from the file /etc/profile, if that file exists. After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, ...


3

You could use a script for your own user-defined cp command that checks file extensions and uses chmod appropriately... You could do something simple like: (using install rather than cp chmod as per @fd0. That's smarter anyway.) #!/bin/bash args=("$@") dest="${args[@]:(-1)}" unset args[${#args[@]}-1] if [ ! -d "$dest" ]; then echo "Please specify a ...


3

This is common ever-green for sftp. From SuperUser: Background This is ever lasting problem of sftp and sharing files. It is because of the resulting permissions are based on the original permission of the file on the user side and umask (-u) argument is not forcing such permissions, but only stripping the unwanted permissions. This means that only if user ...



Only top voted, non community-wiki answers of a minimum length are eligible