I cannot get the default umask for a session to be 0077.

I have edited /etc/login.defs and set the value to 077 there:

UMASK           077

Also I've made sure the following entry exists in /etc/pam.d/common-session:

session optional                        pam_umask.so

While this configuration seems to work when the user logs in using su it doesn't when the login happens through mdm. Both mdm and su configuration files in pam.d include common-session.

username@hostname ~ $ umask
username@hostname ~ $ su username
username@hostname ~ $ umask

This problem does not occur when using GDM or LIGHTDM instead of MDM.

Any ideas on what could be a possible cause of this?

  • Maybe the directive needs to be in another pam module as well. – mdpc Apr 8 '13 at 0:14
  • @mdpc I have no idea what module you could possibly mean. Above the said entry in common-session a comment says that the umask value is read from /etc/login.defs. – d_inevitable Apr 8 '13 at 0:23
  • Check the home directories of these users; where is the server from? Do they have .bashrc files that set their umask? How do these users login? Through VNC or locally on the machine? You might also check .xinitrc for both the local logins and VNC; some distributions have umask setting there. – Bichoy Apr 8 '13 at 0:58
  • Check if there is something in /etc/profile or any of the other files the shell sources on startup. – vonbrand Apr 8 '13 at 1:06
  • @vonbrand I've checked all of those possibilities. I even did a grep umask on all of /etc to see if there is something still on 022. – d_inevitable Apr 8 '13 at 1:08

This doesn't directly answer your question but this technique might help you shed some light on if there's a stray umask command being run somewhere as part of your shell's config files:

$ bash -x -l -i -c 'exit' 2>&1 | grep 'umask'
  • -x -> enable debugging
  • -l -> login shell
  • -i -> interactive shell
  • -c -> command

The exit is necessary so that the shell returns once it's done.


$ bash -x -l -i -c 'exit' 2>&1 | grep umask
+ umask 002

I found the above technique over in this U&L Q&A titled: How to test for possible conflicts while using alias in bashrc?.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.