Tag Info

Hot answers tagged

7

022 makes things convenient. 077 makes things less convenient, but depending on the circumstances and usage profile, it might not be any less convenient than having to use sudo. I would argue that, like sudo, the actual, measurable security benefit you gain from this is negligible compared to the level of pain you inflict on yourself and your users. As a ...


6

Start a subshell: (umask 22 && cmd) Then the new umask will only alter that subshell. Note that zsh executes the last command of the subshell in the subshell process instead of forking another one, which means that if that command is external, you're not even wasting a process, it's just that the fork is done earlier (so the umask is done in the ...


5

With the umask command... dennis@lightning:~$ umask 0002


5

Unix permissions don't apply to and can't be mapped to Windows permissions, so chmod is necessarily a no-op. (FAT doesn't have permissions at that granularity, and NTFS permissions are stored not by username or numeric ID but by a UUID that Linux has no access to.) The permissions you see are manufactured by the umask=002 part of the mount options.


5

For directories, what may work for you is using Extended ACLs and the masks, if you're on Linux. You can have a separate umask for each user by putting the umask xxx command into their ~/.profile.


5

If you only create directories with the mkdir command at the shell prompt, you could have: umask 7 mkdir() (umask 2 && command mkdir "$@") In your shell customisation file (~/.zshrc for zsh, ~/.bashrc for bash...). That is set the umask to 7, but redefine mkdir to a function where the real mkdir is called (with the same arguments ("$@")) with a ...


4

The umask, in the way you mean it, is a property of the login shell. It is set in .profile or one of its relatives. Since scp doesn't log in interactively, it doesn't run any of these scripts, so it doesn't get the umask setting you've defined there. The closest thing I can think of to what you want is to set the permissions appropriately on the file ...


4

There are three normal ways to set a user's umask. Set UMASK in /etc/login.defs Add pam_umask.so to your PAM configuration in /etc/pam.d Set it in the shell startup files, e.g. /etc/profile There is no difference between system users and normal users in this regard. But I'm assuming you're trying to start a daemon with a custom umask? The problem is: ...


4

umask doesn't enforce rights, it forbids them. Have a look at strace: file: open("newfile", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3 directory: mkdir("newdir", 0777) = 0 touch doesn't ask for execution rights for a file (which wouldn't make sense).


4

The shell uses 0666 for the default permissions when creating a new file. As umask only removes permissions, never adds them, that is what the resultant file will have.


4

Assume the default mask of 0666. umask 0022 would make the new mask 0644 (0666-0022=0644) meaning that group and others have read (no write or execute) permissions. The "extra" digit (the first number = 0), specifies that there are no special modes. If mode begins with a digit it will be interpreted as octal otherwise its meant to be symbolic. 0 is a ...


4

As @terdon stated in his comment, .bashrc is relevant only for users using bash. This is because the file is sourced when bash is launched. To achieve what you want to do, the easiest solution is to add the option -u to the line that reads something like Subsystem sftp /usr/lib64/misc/sftp-server in /etc/ssh/sshd_config. For example : Subsystem sftp ...


3

The manpage for init describes the contents of /etc/default/init, and says: CMASK The mask (see umask(1)) that init uses and that every process inherits from the init process. If not set, init uses the mask it inherits from the kernel. Note that init always attempts to apply a umask of 022 before creating ...


3

cd doesn't change the umask. Either you've overloaded cd, or you have a pre- or post-command hook. Check that cd hasn't been overloaded by running type cd. This will show you whether it's a “shell builtin” (good) or an alias or function (suspicious). Run echo "$PROMPT_COMMAND" to see if you have a post-command hook (bash evaluates the value of this ...


3

Answering the question in your subject: OpenSuSE uses the traditional Unix umask setting, instead of the Debian-inspired one adopted by some other Linux distributions. Editing /etc/login.defs should be sufficient to change it; this will not affect users currently logged in, nor is there any way for you to force such a change to programs that are currently ...


3

The umask 022 (or 0022) is the commonly used umask for UNIX systems which use the traditional style of user account management. In the traditional style of account management, when a user is created, the user is given a default group which would be something like a team or department, or maybe as simple as "users". setgid directories (we could call them ...


3

vfat and ntfs filesystem don't contain any information to represent your unix file permissions. It will not be possible to set some specific permissions to the files and keep them. It is possible to set the initial permissions to a specific value and use this also for the creation of new files. This is called umask and supported by the mount command. You ...


3

From man bash, in the INVOCATION section: When bash is invoked as an interactive login shell, or as a non-inter‐ active shell with the --login option, it first reads and executes com‐ mands from the file /etc/profile, if that file exists. After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, ...


2

The most obvious downside is when you start creating files/directories in a shared directory, expecting other users to access them. Of course, it's only a matter of not forgetting to set the correct umask before doing stuff that need to be shared by all users. Another caveat (not really a downside, once you are aware of it) is when you start doing sudo ...


2

I don't know if it's proper to answer my own question. Editors, please, advise on this if this is not the case. Thanks in advance. I think I've solved this mystery: the problem was the lack of a default ACL on the XFS volumes. Here's the ACL entry for /srv/backups, one of the directories affected: # file: srv/backups # owner: root # group: root user::rwx ...


2

System users differ from ‘normal’ ones in three ways: password expiry, home directory (system users don't have one), and UID (system users are usually below some arbitrary threshold). In the general case, you're almost entirely out of luck. You can use PAM to set the umask, but PAM selects behaviours based on things other than these three differences. In ...


2

Most unix systems have a 002 umask, i.e. only the user can write files by default. Having a 022 umask can be useful on systems where each user is in their own primary groups. However, this umask is fraught with dangers. It leads to a lot of support problems with .ssh directories that are group-writable and hence ignored by the SSH daemon. It leads to ...


2

The AIX ftpd doesn't provide per-user umask settings. You can set a global umask value with the -u switch, but neither the command line nor the configuration file allow you to set this on a per-user basis. Note that you can set the umask, and run chmod, from the client side with SITE commands: SITE UMASK 002 SITE CHMOD 600 your_file


2

Umaks on all UNIX based systems that I know of are process specific, not directory specific. You will need to make some fancy hacks to your environment to automaticaly set the umask for the process when changing to your specific directory or play with ACLs for more control.


2

You can mount the directory with specific permissions and effective umask using bindfs. See http://www.cs.helsinki.fi/u/partel/bindfs_docs/bindfs.1.html.


2

You need to use default ACLs. Note that the syntax is a bit different, and is based on the positive permissions, not the negative permissions mask, e.g. rwxr-x--- would be 750 rather than 027. For example setfacl -m d:u::7,g::5,o:0 /path/to/foo or setfacl -m d:u::rwx,g::r-x,o:- /path/to/foo will make it so that files and directories created under ...


2

This is perfectly normal behaviour, but probably not what you intend. The umask 055 settings are there for the duration of the os.system call, so they never change the settings for the Python script, and certainly not for the command called in the next os.system() call. What you should do is something like: import os old_mask = os.umask(055) ...


2

When you run umask with system it runs in a shell: umask changes the mask of that shell, but the shell then immediately terminates and the change is lost. To change the umask of your Python process, use os.umask(), which will: Set the current numeric umask and return the previous umask. That way the change will be made to your running program, rather ...


1

You could wrap it in a shell script. umask inherits to all child processes. cmd.sh: umask 0022 cmd


1

To make sure a command is called with a specific command, you could wrap it inside a script or a function that starts a subshell with the umask updated. You could put that function definition in your shell configuration file like .bashrc for bash or .zshrc for zsh. Something like: brew() ( umask 002 && command brew "$@" )



Only top voted, non community-wiki answers of a minimum length are eligible