How can I override the umask setting for all users for a specific folder?

Question

I am running RHEL6. I have a requirement to have "umask 077" in my /etc/bashrc which I am not allowed to change. We have a folder designated for group collaboration where we would like everyone in the same group to be able to rwx. Therefore, users must set "umask 002" manually or in their local .bashrc file or remember to chmod. They often forget and the administrator gets called upon to "fix" permissions because the owner of the file is not available.

Is there a way I can force the folder to "umask 002"? I've read that I should use setfacl but I think umask overrides this.

Answer 1

See How do I force group and permissions for created files inside a specific directory?

What I tested was to create a directory /var/test. I set the group to be tgroup01. I made sure anything created under /var/test would be set to the tgroup01 group. I then made sure the default group permissions for anything underneath /var/test were rwx.

sudo mkdir /var/test
sudo chgrp tgroup01 /var/test
sudo chmod 2775 /var/test
sudo setfacl -m "default:group::rwx"

If I then create a directory foo or touch a file blah, they have the correct permissions

ls -al /var/test

drwxrwsr-x+  3 root   tgroup01  .
drwxr-xr-x   5 root   root      ..
-rw-rw-r--   1 userA  tgroup01  blah
drwxrwxr-x+  2 userA  tgroup01  foo

Answer 2

The setgid bit won't help you - it only affects ownership, not what the owner can do with the file.

What may work is if the shared storage area is mounted on a different file system. You'll need to get the administrator to mount it with the proper umask explicitly set so you can share files. Or, the files are mounted by an internal-only samba share - kind of overkill, but samba easily allows a specific group and permission model vs. what the OS provides.

In short - some of us think the "S" in "ITS" stands for service. If they have the requirement of a 077 umask, then they need to come up with an efficient way of sharing the files for you.

(and for the setgid bit not working)

ivan@darkstar:~$ umask
0002
ivan@darkstar:~$ 
ivan@darkstar:~$ umask 077
ivan@darkstar:~$ umask
0077
ivan@darkstar:~$ mkdir te
ivan@darkstar:~$ ls -ld te
drwx------ 2 ivan ivan 4096 Sep  7 18:53 te
ivan@darkstar:~$ umask 2
ivan@darkstar:~$ umask
0002
ivan@darkstar:~$ groups
ivan adm cdrom sudo dip plugdev lpadmin sambashare kvm webdev
ivan@darkstar:~$ sudo chown .webdev te
ivan@darkstar:~$ sudo chmod g+w te
ivan@darkstar:~$ ls -ld te
drwx-w---- 2 ivan webdev 4096 Sep  7 18:53 te
ivan@darkstar:~$ chmod g+rx te
ivan@darkstar:~$ sudo chmod g+s te
ivan@darkstar:~$ ls -ld te
drwxrws--- 2 ivan webdev 4096 Sep  7 18:53 te
ivan@darkstar:~$ cd te
ivan@darkstar:~/te$ umask 077
ivan@darkstar:~/te$ umask
0077
ivan@darkstar:~/te$ touch test
ivan@darkstar:~/te$ ls -l
total 0
-rw------- 1 ivan ivan 0 Sep  7 18:54 test
ivan@darkstar:~/te$ 

Answer 3

You can achieve this by using special permission "setgid bit".

The setgid bit has effect on both files and directories. In the first case, the file which has the setgid bit set, when executed, instead of running with the privileges of the group of the user who started it, runs with those of the group which owns the file.

When used on a directory, instead, the setgid bit alters the standard behavior so that the group of the files created inside said directory, will not be that of the user who created them, but that of the parent directory itself. This is often used to ease the sharing of files (files will be modifiable by all the users that are part of said group).

If we want to set the setgid bit on a directory use below command.

$ chmod 2775 test_dir

with this above command we gave full privileges on it to it's owner and to the user that are members of the group the directory belongs to plus read and execute permission for all the other users.

We can set this by other way as mentioned below

$ chmod g+s test_dir

Example

We have created multiple users with the name user1, user2, user3:

$ useradd user1
$ useradd user2
$ useradd user3

Also created a group with the name group:

$ groupadd group

Added group as a secondary group in created users:

$ usermod -a -G group user1
$ id user1
uid=1000(user1) gid=1000(user1) groups=1000(user1),1003(group)

$ usermod -a -G group user2
$ id user2
uid=1001(user2) gid=1001(user2) groups=1001(user2),1003(group)

$ usermod -a -G group user3
$ id user3
uid=1002(user3) gid=1002(user3) groups=1002(user3),1003(group)

Created test_dir and added the setgid bit permission:

$ mkdir test_dir
$ chmod 2775 test_dir
$ ls -al 
drwxrwsr-x   5 user group  4096 Sep  7 17:10 test_dir

Created files & directories in test_dir using created users:

$ cd test_dir

$ su user1
$ mkdir user1_dir
$ touch user1_file

$ su user2
$ mkdir user2_dir
$ touch user2_file

$ su user3
$ mkdir user3_dir
$ touch user3_file

Here is test_dir directory listing:

$ ls -al
total 44
drwxrwsr-x 5 user  group 4096 Sep  7 17:10 .
drwxr-xr-x 1 root  root  4096 Sep  7 17:35 ..
drwxrwsr-x 2 user1 group 4096 Sep  7 17:11 user1_dir
-rw-rw-r-- 1 user1 group    0 Sep  7 17:10 user1_file
drwxrwsr-x 2 user2 group 4096 Sep  7 17:09 user2_dir
-rw-rw-r-- 1 user2 group    0 Sep  7 17:09 user2_file
drwxrwsr-x 2 user3 group 4096 Sep  7 17:09 user3_dir
-rw-rw-r-- 1 user3 group    0 Sep  7 17:09 user3_file

Hope this solution works for you.