0

i guess i'm still missing something, but after some time of researching (without any clear statements), i have to consult the experts:

i'm using Linux Mint MATE (Ubuntu based) and know, therefore a users home is world readable (UMASK 022) by default. IMHO a very bad practice!
i'm also aware of, that as long as "user and group are corresponding" (set by USERGROUPS_ENAB in /etc/login.defs), the umask for the group is ignored and the user value is also used for the group permission... so permissions for new folders/files are 775/664 (which is equal to UMASK 002).
i've also read a bunch of manuals, Q&As like permissions 755 on /home/<user>/ etc...

IMHO better permissions would be 750/640 (UMASK 027), but i'm aware that i will only get 770/660...
so i tried to "harden" the system and set UMASK 027 in /etc/login.defs. i also checked /etc/profile, /etc/bash.bashrc, ~/.profile and ~/bashrc, but i only saw a #umask 022 (commented) in ~/.profile.

so as far as i know everything should be fine and UMASK 027 resp. UMASK 007 from /etc/login.defs applied for new folders/files (after a restart).
but new folders/files now get the permissions 755/644!?! so something changed, but not as planed! - funny: e.g. the new apt.list after adding a PPA now has the desired permissions 640.

to be on the safe side i also changed the permissions of an existing home and its containing folders & files via find $HOME/ -perm /o+rwx ! \( -path "$HOME/.*" -o -type l -o -xtype l \) -execdir chmod -c o-rwx "{}" \; (excluded soft-links and dot-files to not mess around with them for now) to ??0.
but still no luck, new folders/files (and i'm not talking about user templates) still have permissions 755/644.


so what is defining system wide the permissions of new folders/files? ...or is preventing the system wide application of the UMASK 027 set in /etc/login.defs?

3 Answers 3

1

You want to create a file /etc/profile.d/umask.sh that contains your UMASK-setting. All files matching /etc/profile.d/*.sh are usually sourced by /etc/profile.

You can also set it directly in /etc/profile, but it may get overwritten by system updates in the future.

see https://superuser.com/a/671690

1

The /etc/login.defs file is the configuration file for the shadow password suite configuration file. From man login.defs:

This page is part of the shadow-utils (utilities
for managing accounts and shadow password files)
project.

Much of the functionality that used to be
provided by the shadow password suite is now
handled by PAM. Thus, /etc/login.defs is no
longer used by passwd(1), or less used by
login(1), and su(1). Please refer to the 
corresponding PAM configuration files instead.

Apparently, the value of UMASK in /etc/login.defs is not read by login. But it is read by the pam_umask PAM module, if the module is in use.

2
  • thank you for your heads up! - so /etc/login.defs is not read by login and my wrong assumption was that it applies umask system wide... so is there a possibility to apply umask globally? Dec 28, 2019 at 17:56
  • You can enable the pam_umask PAM module. See man pam_umask. Or you could edit the files in /etc/skel, which useradd copies to the home directory of new users. Dec 28, 2019 at 18:07
0

If you're in multiple user system or managing one, you can set umask to 077 to restrict new created files and folders that only owner can be able to read/write/execute.

Change permissions to 022 when you want to install some packages.

Disclaimer: I don't understand your post much, so this just to give you some sense that the practice I used.

4
  • well... this is completely clear to me, but the problem is umask 027 is not even working properly (and the group value is pointless at my setup), so umask 077 won't work either. Dec 28, 2019 at 17:18
  • is my or your bad english the problem why you don't understand the question? - if it is mine, please be more specific and give me some hints, that i can rephrase my question. (...and please excuse my bad english! ;-) ) Dec 28, 2019 at 17:21
  • I set umask in .zshrc. If you use bash, set it in .bashrc.
    – Tuyen Pham
    Dec 28, 2019 at 17:38
  • i know, that this is a possible workaround... but i'm asking for a global setting. Dec 28, 2019 at 17:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .