0

i guess i'm still missing something, but after some time of researching (without any clear statements), i have to consult the experts:

i'm using Linux Mint MATE (Ubuntu based) and know, therefore a users home is world readable (UMASK 022) by default. IMHO a very bad practice!
i'm also aware of, that as long as "user and group are corresponding" (set by USERGROUPS_ENAB in /etc/login.defs), the umask for the group is ignored and the user value is also used for the group permission... so permissions for new folders/files are 775/664 (which is equal to UMASK 002).
i've also read a bunch of manuals, Q&As like permissions 755 on /home/<user>/ etc...

IMHO better permissions would be 750/640 (UMASK 027), but i'm aware that i will only get 770/660...
so i tried to "harden" the system and set UMASK 027 in /etc/login.defs. i also checked /etc/profile, /etc/bash.bashrc, ~/.profile and ~/bashrc, but i only saw a #umask 022 (commented) in ~/.profile.

so as far as i know everything should be fine and UMASK 027 resp. UMASK 007 from /etc/login.defs applied for new folders/files (after a restart).
but new folders/files now get the permissions 755/644!?! so something changed, but not as planed! - funny: e.g. the new apt.list after adding a PPA now has the desired permissions 640.

to be on the safe side i also changed the permissions of an existing home and its containing folders & files via find $HOME/ -perm /o+rwx ! \( -path "$HOME/.*" -o type l -o -xtype l \) -execdir chmod -c o-rwx "{}" \; (excluded soft-links and dot-files to not mess around with them for now) to ??0.
but still no luck, new folders/files (and i'm not talking about user templates) still have permissions 755/644.


so what is defining system wide the permissions of new folders/files? ...or is preventing the system wide application of the UMASK 027 set in /etc/login.defs?

1

The /etc/login.defs file is the configuration file for the shadow password suite configuration file. From man login.defs:

This page is part of the shadow-utils (utilities
for managing accounts and shadow password files)
project.

Much of the functionality that used to be
provided by the shadow password suite is now
handled by PAM. Thus, /etc/login.defs is no
longer used by passwd(1), or less used by
login(1), and su(1). Please refer to the 
corresponding PAM configuration files instead.

Apparently, the value of UMASK in /etc/login.defs is not read by login. But it is read by the pam_umask PAM module, if the module is in use.

| improve this answer | |
  • thank you for your heads up! - so /etc/login.defs is not read by login and my wrong assumption was that it applies umask system wide... so is there a possibility to apply umask globally? – DJCrashdummy Dec 28 '19 at 17:56
  • You can enable the pam_umask PAM module. See man pam_umask. Or you could edit the files in /etc/skel, which useradd copies to the home directory of new users. – Johan Myréen Dec 28 '19 at 18:07
1

You want to create a file /etc/profile.d/umask that contains your UMASK-setting.

see https://superuser.com/a/671690

| improve this answer | |
0

If you're in multiple user system or managing one, you can set umask to 077 to restrict new created files and folders that only owner can be able to read/write/execute.

Change permissions to 022 when you want to install some packages.

Disclaimer: I don't understand your post much, so this just to give you some sense that the practice I used.

| improve this answer | |
  • well... this is completely clear to me, but the problem is umask 027 is not even working properly (and the group value is pointless at my setup), so umask 077 won't work either. – DJCrashdummy Dec 28 '19 at 17:18
  • is my or your bad english the problem why you don't understand the question? - if it is mine, please be more specific and give me some hints, that i can rephrase my question. (...and please excuse my bad english! ;-) ) – DJCrashdummy Dec 28 '19 at 17:21
  • I set umask in .zshrc. If you use bash, set it in .bashrc. – Tuyen Pham Dec 28 '19 at 17:38
  • i know, that this is a possible workaround... but i'm asking for a global setting. – DJCrashdummy Dec 28 '19 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.