3

When logged in as root, I have umask set to 077 which causes problems (such as /etc/resolv.conf being unreadable for non-root and thus DNS not working.

I don't know where I have set the umask 077. It is not set in .bashrc or in .profile or in /etc/profile.

Any suggestions where 077 might come from?

I am using Debian Wheezy

2 Answers 2

3

From man bash, in the INVOCATION section:

When bash is invoked as an interactive login shell, or as a non-inter‐ active shell with the --login option, it first reads and executes com‐ mands from the file /etc/profile, if that file exists. After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, in that order, and reads and executes commands from the first one that exists and is readable. The --noprofile option may be used when the shell is started to inhibit this behavior.

Make sure to check all the files mentioned there.

However, I don't see how umask is a "problem" here. The fact that you have 0077 just means that all files created during your interactive shell will be non-accessible by group and other users. In itself, there's nothing wrong with that, it's very safe for your root user. If you need, you can always make a file accessible by other users, all you need is a chmod, for example:

chmod +r /etc/resolv.conf

Note that umask doesn't affect existing files. For example:

$ rm -f ls.out
$ umask 077; ls > ls.out; ls -l ls.out
-rw-------  1 jack  staff  341 Dec 31 19:20 ls.out
$ umask 022; ls > ls.out; ls -l ls.out
-rw-------  1 jack  staff  341 Dec 31 19:20 ls.out

So it's possible that at some point you tested your network setup in your shell, for example by running ifup wlan0, and due to your umask the /etc/resolv.conf file got created too restrictive. Since then on, even if the file is truncated by a non-interactive shell, the permissions stay the same.

I don't know for sure if non-interactive shells use that restrictive umask. Maybe, maybe not. So it's worth checking the files mentioned in the INVOCATION section of man bash. If the snippet I pasted doesn't help, read through the entire section. You could also check these matches:

grep -r umask.*77 /etc/

Finally, although umask 0077 seems nice and secure, maybe it's just too much. When you install something new and play with getting the initial setup right, it's easily possible that you will have similar problems again. I also have Debian/Wheezy and it's 0022 in mine, which I think is the normal default. So when you find where this is set, it's probably ok to change it back to 0022.

2
  • well, it looks that my umask settings affects non-interactive shells as well. How else can you explain, that when I start my network (ifup wlan0), the file /etc/resolv.conf gets created with 600 permissions. I know, of course, that I can change it with chmod. But that only solves the symptom, not the underlying problem. Dec 31, 2013 at 17:51
  • @MartinVegter I added more explanation and suggestions to my post
    – janos
    Dec 31, 2013 at 18:35
2

You can find a detailed umask description here and here

You can check umask value for current login session by umask command. This would be only applicable for current session. If you want to make it permanent you can make an entry to .profile. By default it is defined under /etc/login.defs. or /etc/profile

2
  • thanks, but how does it help to solve my problem ? Dec 31, 2013 at 16:42
  • @MartinVegter With the edit it might, but I agree, the original answer was decidedly non-helpful to your question since you obviously know what the umask is and does.
    – user
    Dec 31, 2013 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .