2

How to set default umask for cron jobs, please? (On RHEL 6.)

Jobs are started under non-interactive (obviously) no-login (?) shell. Not only I prefer dash over bash. But consider also bash called as /bin/sh. It seems, that both shells in non-interactive no-login invocation doesn't read any start-up file like /etc/profile.

Is the default umask hard-wired in shell or it is inherited from cron daemon?

|improve this question

migrated from serverfault.com Apr 22 '15 at 14:42

This question came from our site for system and network administrators.

  • What's the problem with this? In a cron entry you can call any script or binary, and in a script you can source any other file you need to setup the environment. – ott-- Apr 22 '15 at 8:25
  • @JennyD Thank you, move it please. @ott Problem is that default umask is to open. Of course I know umask can be set in script or directly in crontab (umask …; script.sh). But I, as admin, want the default umask to be restrict and a release engineer can, for specific job, set an open umask. Not reversed. – Hans Ginzel Apr 22 '15 at 9:11
5

On RHEL, PAM is used, so you could try using pam_umask

Try putting this in /etc/pam.d/crond

session optional pam_umask.so umask=0022

Naturally, this is untested, and may very well break assumptions made by various applications.

|improve this answer
  • Thank you. It is running for all crontabs (all users). I am afraid of side efects... How to set umask just for one crontab (one system user)? – Hans Ginzel Apr 22 '15 at 11:28
  • I would have hoped you could do this in the crontab file itself (same as you can specify SHELL or MAILTO, or even MAILFROM or RANDOM_DELAY), but it appears not. pam_umask(8) does say you can put it in a user's GECOS information (and therefore into /etc/passwd or whereever you get that information from, such as LDAP -- bit yuck really). It might be better to set SHELL to pass arguments to call a particular init file. – Cameron Kerr Apr 22 '15 at 11:39
0

On >= RHEL7, it can be done by setting UMask value in systemd service

vi /usr/lib/systemd/system/crond.service

[Unit]
Description=Command Scheduler
After=auditd.service systemd-user-sessions.service time-sync.target

[Service]
UMask=0002
EnvironmentFile=/etc/sysconfig/crond
ExecStart=/usr/sbin/crond -n $CRONDARGS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl restart crond.service
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.