Is it possible to set the umask for a system-user (created with useradd --system username)?

3 Answers 3


There are three normal ways to set a user's umask.

  1. Set UMASK in /etc/login.defs
  2. Add pam_umask.so to your PAM configuration in /etc/pam.d
  3. Set it in the shell startup files, e.g. /etc/profile

There is no difference between system users and normal users in this regard.

But I'm assuming you're trying to start a daemon with a custom umask?

The problem is: all of the above options happen when a user logs in. If you're running a daemon, it never logs in. It's started by init, then either runs as root, or calls setuid to run as the system user you specify.

Your main options are:

  1. put umask in your init script (do a grep umask /etc/init.d/* for an example)
  2. configure init to start the program with a custom umask (systemd.exec upstart umask)
  3. if using start-stop-daemon, pass the umask option
  4. modify the program itself to call the umask function or system call
  • Do you know how to set a umask for SSHFS (sftp-server) on Arch Linux (which uses systemd)? As you pointed out, the first 3 options you listed do not have any effect.
    – MountainX
    Commented Sep 23, 2017 at 2:12

System users differ from ‘normal’ ones in three ways: password expiry, home directory (system users don't have one), and UID (system users are usually below some arbitrary threshold).

In the general case, you're almost entirely out of luck. You can use PAM to set the umask, but PAM selects behaviours based on things other than these three differences.

In other words, you can't get PAM to distinguish between a ‘system’ and ‘non-system’ users. This leaves you with two options:

  • Either you use PAM to set the umask for everyone (e.g. check in /etc/login.defs), then explicitly set the umask for non-system users in /etc/bash.bashrc (or similar);

  • Or you write your own PAM module to do this. I think this would be welcomed by many people, as setting the umask is a common request.

Please take this answer with a generous pinch of salt. This sort of request is pretty common, and I wouldn't be surprised if a better/proper way exists now.

  • 1
    There is already a PAM module called pam_umask. The problem is it only works at login time.
    – Mikel
    Commented Apr 11, 2012 at 20:48
  • Ah, I think you knew about pam_umask, but maybe not about pam_succeed_if. With pam_succeed_if, you can make any other module apply only to a given user or group. But I still don't think PAM will help here.
    – Mikel
    Commented Apr 12, 2012 at 14:43

As @Mikel suggests, if you are trying to configure a system account which is a daemon, try configuring the daemon itself.

I came to this question looking how to set the umask for the _www account on MacOS. While this is difficult as the answers above suggest, I found I could solve it by configuring the apache service as (in this case) the user == a daemon.

I strangely couldn't find the startup script (normally in /etc/init.d/ but on a mac in Library/LaunchDaemons/), but with help from: http://krypted.com/mac-security/apache2-umasks/ discovered that apache has its own specific environment script.

$ sudo vim /usr/sbin/envvars
    umask 002

Possibly other daemons have similar methods, which might help in specific cases.

  • But how were you able to write "umask 002" into this file?!?!? I get a permission denied error even as root/sudo and according to apple even roots are not allowed to write/change anything in the /usr/sbin directory support.apple.com/en-gb/HT204899 Commented Dec 16, 2019 at 3:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .