I cannot get the default umask for a session to be 0077.

I have edited /etc/login.defs and set the value to 077 there:

UMASK           077

Also I've made sure the following entry exists in /etc/pam.d/common-session:

session optional                        pam_umask.so

While this configuration seems to work when the user logs in using su it doesn't when the login happens through mdm. Both mdm and su configuration files in pam.d include common-session.

username@hostname ~ $ umask
username@hostname ~ $ su username
username@hostname ~ $ umask

This problem does not occur when using GDM or LIGHTDM instead of MDM.

Any ideas on what could be a possible cause of this?

  • Maybe the directive needs to be in another pam module as well.
    – mdpc
    Commented Apr 8, 2013 at 0:14
  • @mdpc I have no idea what module you could possibly mean. Above the said entry in common-session a comment says that the umask value is read from /etc/login.defs. Commented Apr 8, 2013 at 0:23
  • Check the home directories of these users; where is the server from? Do they have .bashrc files that set their umask? How do these users login? Through VNC or locally on the machine? You might also check .xinitrc for both the local logins and VNC; some distributions have umask setting there.
    – Bichoy
    Commented Apr 8, 2013 at 0:58
  • Check if there is something in /etc/profile or any of the other files the shell sources on startup.
    – vonbrand
    Commented Apr 8, 2013 at 1:06
  • @vonbrand I've checked all of those possibilities. I even did a grep umask on all of /etc to see if there is something still on 022. Commented Apr 8, 2013 at 1:08

1 Answer 1


This doesn't directly answer your question but this technique might help you shed some light on if there's a stray umask command being run somewhere as part of your shell's config files:

$ bash -x -l -i -c 'exit' 2>&1 | grep 'umask'
  • -x -> enable debugging
  • -l -> login shell
  • -i -> interactive shell
  • -c -> command

The exit is necessary so that the shell returns once it's done.


$ bash -x -l -i -c 'exit' 2>&1 | grep umask
+ umask 002

I found the above technique over in this U&L Q&A titled: How to test for possible conflicts while using alias in bashrc?.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .