Tag Info

Hot answers tagged

7

022 makes things convenient. 077 makes things less convenient, but depending on the circumstances and usage profile, it might not be any less convenient than having to use sudo. I would argue that, like sudo, the actual, measurable security benefit you gain from this is negligible compared to the level of pain you inflict on yourself and your users. As a ...


5

Unix permissions don't apply to and can't be mapped to Windows permissions, so chmod is necessarily a no-op. (FAT doesn't have permissions at that granularity, and NTFS permissions are stored not by username or numeric ID but by a UUID that Linux has no access to.) The permissions you see are manufactured by the umask=002 part of the mount options.


4

The umask, in the way you mean it, is a property of the login shell. It is set in .profile or one of its relatives. Since scp doesn't log in interactively, it doesn't run any of these scripts, so it doesn't get the umask setting you've defined there. The closest thing I can think of to what you want is to set the permissions appropriately on the file ...


4

Assume the default mask of 0666. umask 0022 would make the new mask 0644 (0666-0022=0644) meaning that group and others have read (no write or execute) permissions. The "extra" digit (the first number = 0), specifies that there are no special modes. If mode begins with a digit it will be interpreted as octal otherwise its meant to be symbolic. 0 is a ...


4

umask doesn't enforce rights, it forbids them. Have a look at strace: file: open("newfile", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3 directory: mkdir("newdir", 0777) = 0 touch doesn't ask for execution rights for a file (which wouldn't make sense).


4

As @terdon stated in his comment, .bashrc is relevant only for users using bash. This is because the file is sourced when bash is launched. To achieve what you want to do, the easiest solution is to add the option -u to the line that reads something like Subsystem sftp /usr/lib64/misc/sftp-server in /etc/ssh/sshd_config. For example : Subsystem sftp ...


3

Start a subshell: (umask 22 && cmd) Then the new umask will only alter that subshell. Note that zsh executes the last command of the subshell in the subshell process instead of forking another one, which means that if that command is external, you're not even wasting a process, it's just that the fork is done earlier (so the umask is done in the ...


3

The manpage for init describes the contents of /etc/default/init, and says: CMASK The mask (see umask(1)) that init uses and that every process inherits from the init process. If not set, init uses the mask it inherits from the kernel. Note that init always attempts to apply a umask of 022 before creating ...


3

Answering the question in your subject: OpenSuSE uses the traditional Unix umask setting, instead of the Debian-inspired one adopted by some other Linux distributions. Editing /etc/login.defs should be sufficient to change it; this will not affect users currently logged in, nor is there any way for you to force such a change to programs that are currently ...


3

There are three normal ways to set a user's umask. Set UMASK in /etc/login.defs Add pam_umask.so to your PAM configuration in /etc/pam.d Set it in the shell startup files, e.g. /etc/profile There is no difference between system users and normal users in this regard. But I'm assuming you're trying to start a daemon with a custom umask? The problem is: ...


3

vfat and ntfs filesystem don't contain any information to represent your unix file permissions. It will not be possible to set some specific permissions to the files and keep them. It is possible to set the initial permissions to a specific value and use this also for the creation of new files. This is called umask and supported by the mount command. You ...


3

From man bash, in the INVOCATION section: When bash is invoked as an interactive login shell, or as a non-inter‐ active shell with the --login option, it first reads and executes com‐ mands from the file /etc/profile, if that file exists. After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, ...


2

The most obvious downside is when you start creating files/directories in a shared directory, expecting other users to access them. Of course, it's only a matter of not forgetting to set the correct umask before doing stuff that need to be shared by all users. Another caveat (not really a downside, once you are aware of it) is when you start doing sudo ...


2

I don't know if it's proper to answer my own question. Editors, please, advise on this if this is not the case. Thanks in advance. I think I've solved this mystery: the problem was the lack of a default ACL on the XFS volumes. Here's the ACL entry for /srv/backups, one of the directories affected: # file: srv/backups # owner: root # group: root user::rwx ...


2

The AIX ftpd doesn't provide per-user umask settings. You can set a global umask value with the -u switch, but neither the command line nor the configuration file allow you to set this on a per-user basis. Note that you can set the umask, and run chmod, from the client side with SITE commands: SITE UMASK 002 SITE CHMOD 600 your_file


2

System users differ from ‘normal’ ones in three ways: password expiry, home directory (system users don't have one), and UID (system users are usually below some arbitrary threshold). In the general case, you're almost entirely out of luck. You can use PAM to set the umask, but PAM selects behaviours based on things other than these three differences. In ...


2

cd doesn't change the umask. Either you've overloaded cd, or you have a pre- or post-command hook. Check that cd hasn't been overloaded by running type cd. This will show you whether it's a “shell builtin” (good) or an alias or function (suspicious). Run echo "$PROMPT_COMMAND" to see if you have a post-command hook (bash evaluates the value of this ...


2

You need to use default ACLs. Note that the syntax is a bit different, and is based on the positive permissions, not the negative permissions mask, e.g. rwxr-x--- would be 750 rather than 027. For example setfacl -m d:u::7,g::5,o:0 /path/to/foo or setfacl -m d:u::rwx,g::r-x,o:- /path/to/foo will make it so that files and directories created under ...


1

This answer is bash specific, other shells have similar features, but since your answer mentioned .bashrc I'm going to assume you're using Bash. What you're encountering is that a shell can either be invoked as an interactive or a login shell. bash -l - login bash -i - interactive If you look in the Bash man page in the "INVOCATION" section you'll ...


1

You can check using : for user in $(awk -F: '{print $1}' /etc/passwd); do printf "%-10s" "$user" ; su -c 'umask' -l $user 2>/dev/null done To avoid checking system user do : for user in $(awk -F: '( $3 >= 500 ){print $1}' /etc/passwd); do printf "%-10s" "$user" ; su -c 'umask' -l $user 2>/dev/null done OutPut: ram 0022 shyam ...


1

FAT32 does not have the same space allocated on disc per file for the ownership information and permissions bits. So roughly you could say that file meta information is truncated on storage and then extended on retrieval in the most permissive way (as there is no way to tell some other user created the file). If the system would not do that, you would be ...


1

I would set it in /etc/sysconfig/init because that gets sourced later on in the .etc/init.d/functions script than the explicit umask command does and as such it takes precedence. Not to mention /etc/init.d/functions is a script file whereas /etc/sysconfig/init is a configuration file. Scripts may be updated by rpm but newer config files just get saved as ...


1

The umask value is permissions to deny, taken off whatever permissions would be given by default. A directory requires search permission, so unless overriden its permissions are 0777 (rwxrwxrwx), with the typical umask of 0002 it leaves 0775 (rwxrwxr-x). For an executable the same (x means execute here); for a regular file default permissions are no execute, ...


1

To make sure a command is called with a specific command, you could wrap it inside a script or a function that starts a subshell with the umask updated. You could put that function definition in your shell configuration file like .bashrc for bash or .zshrc for zsh. Something like: brew() ( umask 002 && command brew "$@" )


1

I think you're problem is that you have access control list getting applied here as well. Notice the directory, def? It has a trailing '+' which means that there is ACL permissions getting applied here as well. Can you run the command getfacl at your $HOME directory level? This will give us more insight into what's going on. For example: % getfacl . # ...


1

To my knowledge there doesn't exist a Vim function that accomplishes what you're asking for. But I came up with my s:Get_file_perm function whose result I assign to the w:file_perm variable: " ... let w:file_perm=<sid>Get_file_perm() " ... function! s:Get_file_perm() let a=getfperm(expand('%:p')) if strlen(a) return a else let ...


1

Most unix systems have a 002 umask, i.e. only the user can write files by default. Having a 022 umask can be useful on systems where each user is in their own primary groups. However, this umask is fraught with dangers. It leads to a lot of support problems with .ssh directories that are group-writable and hence ignored by the SSH daemon. It leads to ...


1

One difference between e.g. RHEL and (open)SuSE is that RHEL follows the User Private Group scheme in which the primary group of each user is a private group with the same name as the username. (open)SuSE sets the private group of all users to "users" if I'm not mistaken. Naturally a umask that allows members of a user's group to read all files is not ...


1

If the "owner2" will have umask 077 it will clear group and other permissions from the list for all files created while this is set. The problem of course would be that "owner1" won't be able to read those files. If there is a specific program that creates files in "dir1" then the shell from which this program has been started can have umask 077 set for ...


1

There is no group mask for the dir and files as said by karslon. Instead, you can use the group-id SGID or setgid: It inherits rights of the group of the owner of the file on execution. For directories it also may mean that when a new file is created in the directory it will inherit the group of the directory (and not of the user who created the file). ...



Only top voted, non community-wiki answers of a minimum length are eligible