CODEWITHSUNDEEP
linuxsystemumask
HansHarhoff
HansHarhoff

Reputation: 2007

How to set system wide umask?

I am working in a lab where we are running Linux (Debian and Ubuntu). Usernames and group names are handled by NIS and yp. We have some common users that everybody has access to that run the experiments and then we each have our own users in addition there is a common group that we are all a member of.

How can I make such that all files and directories on the shared /home/ drive (NFS) is read/write(/executable) by user/group? Basically what I want is

chmod -R 664 /home
chgrp -R commongroup /home

or equivalently umask 0002.

But running the above commands only fixes the current files in the folders and umask only works for single users and has to be run every time a user logs in ie. in the .bashrc file (and will this work for changes mode via gnome?). Is there a system wide command or setting that I could use to make sure that our commongroup has write access to the common files?

Upvotes: 72

Views: 88917

Answers (5)

Apostle
Apostle

Reputation: 1

This helped me I have a Debian 12 machine.

A hard system-wide default set in /etc/pam.d/common-session. To set it this way, replace the line from that file mentioned above with this:

session optional pam_umask.so umask=002

This worked but only from bash terminal.

The file manager was not getting my desired permission for the group.

Thunar was launching as a Daemon with systemd. I killed and it started working when launching again.

This is what I tried and it worked!

edit the /etc/pam.d/common-session-noninteractive

add the following line

session optional pam_umask.so umask=002

reboot the system

Now when I create with Thunar or zim the directory or files have my desired permissions.

I hope this helps.

Upvotes: 0

ephemient
ephemient

Reputation: 205034

Both Debian and Ubuntu ship with pam_umask. This allows you to configure umask in /etc/login.defs and have them apply system-wide, regardless of how a user logs in.

To enable it, you may need to add a line to /etc/pam.d/common-session reading

session optional pam_umask.so

or it may already be enabled. Then edit /etc/login.defs and change the UMASK line to

UMASK           002

(the default is 022).

Note that users may still override umask in their own ~/.profile or ~/.bashrc or similar, but (at least on new Debian and Ubuntu installations) there shouldn't be any overriding of umask in /etc/profile or /etc/bash.bashrc. (If there are, just remove them.)

Upvotes: 108

Ahmad Ismail
Ahmad Ismail

Reputation: 13982

I do not know about other distros, but if you are using Debian or Ubuntu, run

sudo sh -c " echo 'umask 027' > /etc/profile.d/umask.sh"

Change 027 to the value that best suits you.

Now restart your Machine.

voila!!! You are done.

For more details, please check Going crazy over umask in Ubuntu!!!!!!. The gist is, as we want to keep the useradd and userdel behavior - and we probably want system defaults for other accounts - the fix is to uncomment the umask line in ~/.profile, then log out and log back in.

However, ~/.profile is for a particular user. For, system wide change, you need to create a file under /etc/profile.d/ or add umask 027 to /etc/profile.

Upvotes: 0

Yitz
Yitz

Reputation: 5117

First, make sure that the pam-modules package is installed. That makes the pam_umask module available. Then make sure that /etc/pam.d/common-session has a line of the form

session optional pam_umask.so

so that pam_umask is enabled.

Now, according to the pam_umask man page, the default umask is determined at login by checking each of the following places, in order:

  1. A hard system-wide default set in /etc/pam.d/common-session. To set it this way, replace the line from that file mentioned above with this:

    session optional pam_umask.so umask=002

  2. An entry in an individual user's GECOS field in /etc/passwd overrides a soft system-wide default for that specific user. Create that entry using a command of the form:

    chfn --other='umask=002' username

  3. An line of the form UMASK=002 in /etc/default/login (you may need to create that file) sets a soft system-wide default.

  4. The UMASK value from /etc/login.defs. That value is also used for something else (computing the permissions on the home directory of a new user that is being created; see the comments in /etc/login.defs for more details). So it is best to avoid relying on this for setting the default umask for regular logins, to keep things separate.

So in your case, you should configure this either in /etc/default/login if you want it to be possible to override the setting for individual users, or set it in /etc/pam.d/common-session as described above if you want it to be the same for all users.

Note that even with the hard default setting, users can still override the default umask manually by using the umask command at the shell prompt or in their .profile script.

Also note that the traditional Unix way to set this default is by adding a umask command to /etc/profile, and that would also still work. But it's not the recommended way to configure things like this on Ubuntu, because that is hard to manage reliably using scripts and GUIs.

Note, unfortunately this stopped working for any application which has been converted to launch via systemd --user.

Upvotes: 31

speedstream
speedstream

Reputation: 1

In order to match up the group rights, on the server, the set gid bit (one of the "sticky bits") can be considered as an additional option.

If the shared directory is linked to the group, launching (using root) : chmod -R 2775 folder_for_the_group may be interesting.

For any new file created in the folder, the creator will be the owner, but the group will be automatically specified (as long as the creator is part of the group).

Rights' grid now appears as -rwxrwsr-x+

Upvotes: 0

Related Questions