0

There is a particular program that creates files and directories with permissions 600 and 700, respectively. It creates them within its own working directory, /home/me/program. I want those permissions to be 660 and 770 instead. The program is closed source, so changing it isn't an option. The umask is 002, so I know it isn't restricting the group permission. The program is simply specifying a restrictive permission on its own.

I considered setting a default ACLs, but it turns out that ACLs can only make a standard permission set more restrictive, not less.

I could probably react to file/dir creation events with inotifywait and issue chmod commands in response, but that feels kind of ugly.

I was hoping you guys would have a better way!

Improve this question
4
  • 1
    There is no way to coerce a program from the "outside" to create files using a prescribed umask. Poking the binary is probably your best hope.
    – Satō Katsura
    Feb 16, 2017 at 6:30
  • umask can remove permissions that a program specifies to creat or equivalent but cannot add them. If your Unix supports ACLs, and the program doesn't set them, I think a default ACL on the directory can't grant access to the owning group but can to another group or other user(s) which might suffice for you. Whether that is less ugly I offer no opinion.
    – dave_thompson_085
    Feb 16, 2017 at 12:41
  • You haven't posted what your system's umask is set to, so the best way to proceed is impossible to know. If, for example, your system's umask is set to 077, setting it to 007 would do what you want - assuming the program doesn't set it's own umask or explicitly set the file and directory permissions. To get a real "best answer", you need to provide a lot more information.
    – Andrew Henle
    Feb 16, 2017 at 15:00
  • The umask is set to 002. As dave_thompson_085 pointed out, though, the umask can only remove permissions from the creat call. It can't add them. I looked into ACLs as well. Default ACLs seemed like the perfect solution to my problem, until I discovered that they can only make the standard Linux permissions more restrictive. So for example, if the file's permissions are 777, an ACL can deny permissions for a named group. But if permissions are 700, ACLs can't grant those permissions. Too bad.
    – Sergey
    Feb 17, 2017 at 9:58

1 Answer 1

Reset to default
1

A solution may be to set the permissions independently from outside the binary. Depending on context and requirements, you could either create a cron job calling a script, wrap the call to the binary along with subsequent cleanup code in a script or implement something more sophisticated using the inotify(7) interface.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.