The umask 022
(or 0022
) is the commonly used umask for UNIX systems which use the traditional style of user account management. In the traditional style of account management, when a user is created, the user is given a default group which would be something like a team or department, or maybe as simple as "users". setgid directories (we could call them "team directories") do not work as expected, because the files are not writable for other team members unless the user makes them writable explicitly. This is not very practicable, especially when the files are opaque to the user, as it would be the case with, for example, a git repository. This is not considered a problem because ACLs provide a perfect solution for that.
The umask 002
(or 0002
) is the commonly used umask for UNIX systems which use UPG - User Private Groups. When adding a user in an UPG system, the system creates a group with the same name and group id as the user name and user id. UPG is a Debian-inspired approach of user account management. As you've just experienced, UPG has some advantages when it comes to setgid directories - as long as users do not override their umask. ACLs are safe from that override.
The best solution is to refactor your user and group accounts and enable UPG, then you're "safe".
Warning! When you take a shortcut and simply change the umask in /etc/login.defs
to 002
(or 0002
) instead of 022
(or 0022
), be aware that all files created by all users will per default now be writable by all other users in the same group. This is a security risk, so this is almost certainly not what you want.
One of the reasons for the introduction of the UPG system was that it allows administrators to configure a umask of 002
(or 0002
) instead of 022
(or 0022
) to easily facilitate the setgid bit for collaborative work on projects without the described security risk.
As far as I know, OpenSUSE does not offer a way to enable UPG during installation or YaST and the only way to use UPG is to purely use the command line for creating user accounts, after making the necessary change to /etc/login.defs
: Change it to have USERGROUPS_ENAB yes
. There's a pitfall here. UPG only works properly if the user id and the group id are identical. If you do that change to a running system, you will first have to change the ids of the existing groups, which involves re-assigning the groups to all files with these groups, and in the context of LDAP, NFS and NIS this can be a bit hairy.
Here's some further reading on this topic, which I found helpful when I was new to the topic of setgid vs. umask and UPGs: