Tag Info

Hot answers tagged

7

022 makes things convenient. 077 makes things less convenient, but depending on the circumstances and usage profile, it might not be any less convenient than having to use sudo. I would argue that, like sudo, the actual, measurable security benefit you gain from this is negligible compared to the level of pain you inflict on yourself and your users. As a ...


5

With the umask command... dennis@lightning:~$ umask 0002


5

For directories, what may work for you is using Extended ACLs and the masks, if you're on Linux. You can have a separate umask for each user by putting the umask xxx command into their ~/.profile.


5

Unix permissions don't apply to and can't be mapped to Windows permissions, so chmod is necessarily a no-op. (FAT doesn't have permissions at that granularity, and NTFS permissions are stored not by username or numeric ID but by a UUID that Linux has no access to.) The permissions you see are manufactured by the umask=002 part of the mount options.


5

If you only create directories with the mkdir command at the shell prompt, you could have: umask 7 mkdir() (umask 2 && command mkdir "$@") In your shell customisation file (~/.zshrc for zsh, ~/.bashrc for bash...). That is set the umask to 7, but redefine mkdir to a function where the real mkdir is called (with the same arguments ("$@")) with a ...


4

There are three normal ways to set a user's umask. Set UMASK in /etc/login.defs Add pam_umask.so to your PAM configuration in /etc/pam.d Set it in the shell startup files, e.g. /etc/profile There is no difference between system users and normal users in this regard. But I'm assuming you're trying to start a daemon with a custom umask? The problem is: ...


4

The umask, in the way you mean it, is a property of the login shell. It is set in .profile or one of its relatives. Since scp doesn't log in interactively, it doesn't run any of these scripts, so it doesn't get the umask setting you've defined there. The closest thing I can think of to what you want is to set the permissions appropriately on the file ...


4

umask doesn't enforce rights, it forbids them. Have a look at strace: file: open("newfile", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3 directory: mkdir("newdir", 0777) = 0 touch doesn't ask for execution rights for a file (which wouldn't make sense).


4

Start a subshell: (umask 22 && cmd) Then the new umask will only alter that subshell. Note that zsh executes the last command of the subshell in the subshell process instead of forking another one, which means that if that command is external, you're not even wasting a process, it's just that the fork is done earlier (so the umask is done in the ...


4

The shell uses 0666 for the default permissions when creating a new file. As umask only removes permissions, never adds them, that is what the resultant file will have.


4

Assume the default mask of 0666. umask 0022 would make the new mask 0644 (0666-0022=0644) meaning that group and others have read (no write or execute) permissions. The "extra" digit (the first number = 0), specifies that there are no special modes. If mode begins with a digit it will be interpreted as octal otherwise its meant to be symbolic. 0 is a ...


4

As @terdon stated in his comment, .bashrc is relevant only for users using bash. This is because the file is sourced when bash is launched. To achieve what you want to do, the easiest solution is to add the option -u to the line that reads something like Subsystem sftp /usr/lib64/misc/sftp-server in /etc/ssh/sshd_config. For example : Subsystem sftp ...


3

The manpage for init describes the contents of /etc/default/init, and says: CMASK The mask (see umask(1)) that init uses and that every process inherits from the init process. If not set, init uses the mask it inherits from the kernel. Note that init always attempts to apply a umask of 022 before creating ...


3

Answering the question in your subject: OpenSuSE uses the traditional Unix umask setting, instead of the Debian-inspired one adopted by some other Linux distributions. Editing /etc/login.defs should be sufficient to change it; this will not affect users currently logged in, nor is there any way for you to force such a change to programs that are currently ...


3

vfat and ntfs filesystem don't contain any information to represent your unix file permissions. It will not be possible to set some specific permissions to the files and keep them. It is possible to set the initial permissions to a specific value and use this also for the creation of new files. This is called umask and supported by the mount command. You ...


3

From man bash, in the INVOCATION section: When bash is invoked as an interactive login shell, or as a non-inter‐ active shell with the --login option, it first reads and executes com‐ mands from the file /etc/profile, if that file exists. After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, ...


2

The most obvious downside is when you start creating files/directories in a shared directory, expecting other users to access them. Of course, it's only a matter of not forgetting to set the correct umask before doing stuff that need to be shared by all users. Another caveat (not really a downside, once you are aware of it) is when you start doing sudo ...


2

I don't know if it's proper to answer my own question. Editors, please, advise on this if this is not the case. Thanks in advance. I think I've solved this mystery: the problem was the lack of a default ACL on the XFS volumes. Here's the ACL entry for /srv/backups, one of the directories affected: # file: srv/backups # owner: root # group: root user::rwx ...


2

System users differ from ‘normal’ ones in three ways: password expiry, home directory (system users don't have one), and UID (system users are usually below some arbitrary threshold). In the general case, you're almost entirely out of luck. You can use PAM to set the umask, but PAM selects behaviours based on things other than these three differences. In ...


2

The AIX ftpd doesn't provide per-user umask settings. You can set a global umask value with the -u switch, but neither the command line nor the configuration file allow you to set this on a per-user basis. Note that you can set the umask, and run chmod, from the client side with SITE commands: SITE UMASK 002 SITE CHMOD 600 your_file


2

Umaks on all UNIX based systems that I know of are process specific, not directory specific. You will need to make some fancy hacks to your environment to automaticaly set the umask for the process when changing to your specific directory or play with ACLs for more control.


2

cd doesn't change the umask. Either you've overloaded cd, or you have a pre- or post-command hook. Check that cd hasn't been overloaded by running type cd. This will show you whether it's a “shell builtin” (good) or an alias or function (suspicious). Run echo "$PROMPT_COMMAND" to see if you have a post-command hook (bash evaluates the value of this ...


2

You can mount the directory with specific permissions and effective umask using bindfs. See http://www.cs.helsinki.fi/u/partel/bindfs_docs/bindfs.1.html.


2

You need to use default ACLs. Note that the syntax is a bit different, and is based on the positive permissions, not the negative permissions mask, e.g. rwxr-x--- would be 750 rather than 027. For example setfacl -m d:u::7,g::5,o:0 /path/to/foo or setfacl -m d:u::rwx,g::r-x,o:- /path/to/foo will make it so that files and directories created under ...


1

You could wrap it in a shell script. umask inherits to all child processes. cmd.sh: umask 0022 cmd


1

To make sure a command is called with a specific command, you could wrap it inside a script or a function that starts a subshell with the umask updated. You could put that function definition in your shell configuration file like .bashrc for bash or .zshrc for zsh. Something like: brew() ( umask 002 && command brew "$@" )


1

I think you're problem is that you have access control list getting applied here as well. Notice the directory, def? It has a trailing '+' which means that there is ACL permissions getting applied here as well. Can you run the command getfacl at your $HOME directory level? This will give us more insight into what's going on. For example: % getfacl . # ...


1

To my knowledge there doesn't exist a Vim function that accomplishes what you're asking for. But I came up with my s:Get_file_perm function whose result I assign to the w:file_perm variable: " ... let w:file_perm=<sid>Get_file_perm() " ... function! s:Get_file_perm() let a=getfperm(expand('%:p')) if strlen(a) return a else let ...


1

Unfortunately usermod -G replaces the user's groups. You wanted usermod -G -a.


1

Most unix systems have a 002 umask, i.e. only the user can write files by default. Having a 022 umask can be useful on systems where each user is in their own primary groups. However, this umask is fraught with dangers. It leads to a lot of support problems with .ssh directories that are group-writable and hence ignored by the SSH daemon. It leads to ...



Only top voted, non community-wiki answers of a minimum length are eligible