home permissins are still too generous

Question

_{i guess i'm still missing something, but after some time of researching (without any clear statements), i have to consult the experts:}

i'm using Linux Mint MATE (Ubuntu based) and know, therefore a users home is world readable (UMASK 022) by default. IMHO a very bad practice!
i'm also aware of, that as long as "user and group are corresponding" (set by USERGROUPS_ENAB in /etc/login.defs), the umask for the group is ignored and the user value is also used for the group permission... so permissions for new folders/files are 775/664 (which is equal to UMASK 002).
i've also read a bunch of manuals, Q&As like permissions 755 on /home/<user>/ etc...

IMHO better permissions would be 750/640 (UMASK 027), but i'm aware that i will only get 770/660...
so i tried to "harden" the system and set UMASK 027 in /etc/login.defs. i also checked /etc/profile, /etc/bash.bashrc, ~/.profile and ~/bashrc, but i only saw a #umask 022 (commented) in ~/.profile.

so as far as i know everything should be fine and UMASK 027 resp. UMASK 007 from /etc/login.defs applied for new folders/files (after a restart).
but new folders/files now get the permissions 755/644!?! so something changed, but not as planed! - funny: e.g. the new apt.list after adding a PPA now has the desired permissions 640.

to be on the safe side i also changed the permissions of an existing home and its containing folders & files via find $HOME/ -perm /o+rwx ! \( -path "$HOME/.*" -o -type l -o -xtype l \) -execdir chmod -c o-rwx "{}" \; (excluded soft-links and dot-files to not mess around with them for now) to ??0.
but still no luck, new folders/files (and i'm not talking about user templates) still have permissions 755/644.

---

so what is defining system wide the permissions of new folders/files? ...or is preventing the system wide application of the UMASK 027 set in /etc/login.defs?

Answer 1

You want to create a file /etc/profile.d/umask.sh that contains your UMASK-setting. All files matching /etc/profile.d/*.sh are usually sourced by /etc/profile.

You can also set it directly in /etc/profile, but it may get overwritten by system updates in the future.

see https://superuser.com/a/671690

Answer 2

The /etc/login.defs file is the configuration file for the shadow password suite configuration file. From man login.defs:

This page is part of the shadow-utils (utilities
for managing accounts and shadow password files)
project.

Much of the functionality that used to be
provided by the shadow password suite is now
handled by PAM. Thus, /etc/login.defs is no
longer used by passwd(1), or less used by
login(1), and su(1). Please refer to the 
corresponding PAM configuration files instead.

Apparently, the value of UMASK in /etc/login.defs is not read by login. But it is read by the pam_umask PAM module, if the module is in use.

Answer 3

If you're in multiple user system or managing one, you can set umask to 077 to restrict new created files and folders that only owner can be able to read/write/execute.

Change permissions to 022 when you want to install some packages.

Disclaimer: I don't understand your post much, so this just to give you some sense that the practice I used.