How to set umask system width?

Question

I work in a laboratory where we work under Linux (Debian and Ubuntu). User names and group names are handled by NIS and yp. We have some common users, everyone has access to these experiment launches, and then each of us has our own users, in addition, there is a common group in which we are all.

How can I make sure that all files and directories on the /home/ (NFS) shared drive are read / written (/ executable) by the user / group? Basically i want

 chmod -R 664 /home chgrp -R commongroup /home 

or equivalent to umask 0002 .

But the execution of the above commands only fixes the current files in folders, and umask works only for single users and should be run every time a user logs in ie. in the .bashrc (and will this work in change mode via gnome?). Is there a system command or settings that I could use to make sure our comm group has write access to shared files?

Answer 1

Both Debian and Ubuntu ships with pam_umask . This allows you to configure umask in /etc/login.defs and apply them throughout the system, regardless of how the user logs in.

To enable it, you may need to add a line to /etc/pam.d/common-session to read

 session optional pam_umask.so 

or it can be turned on. Then edit /etc/login.defs and change the UMASK line to

 UMASK 002 

(default 022 ).

Note that users can still override umask in their own ~/.profile or ~/.bashrc or the like, but (at least in new Debian and Ubuntu installations) there shouldn't be an override of umask in /etc/profile or /etc/bash.bashrc . (If so, just delete them.)

Answer 2

First make sure the pam-modules package is installed. This makes the pam_umask module pam_umask . Then make sure /etc/pam.d/common-session has a line like

 session optional pam_umask.so 

so that pam_umask enabled.

Now, according to the pam_umask man page, by default, umask is detected at login, checking each of the following places to:

• The hard drive set is set to /etc/pam.d/common-session by default. To set it this way, replace the line from the above file as follows:

   session optional pam_umask.so umask=002 

• Entering a separate GECOS user field in /etc/passwd overrides the soft, system-wide default value for that particular user. Create this entry using the form command:

   chfn --other='umask=002' username 

• The line of the form UMASK=002 in /etc/defaults/login (you may need to create this file) sets the soft system default value.

• UMASK value from /etc/login.defs . This value is also used for something else (calculating permissions in the home directory of the new user that is being created, for more details see Comments in /etc/login.defs ). Therefore, it is better not to rely on this to set the default umask as default for regular logins, so that everything is in order.

So, in your case, you must configure this either in /etc/defaults/login if you want to be able to override the parameter for individual users or set it in /etc/pam.d/common-session , as described above, if you want it to be the same for all users.

Note that even with tough default settings, users can still override the default UMASK manually using the UMASK command on the command line or in the .profile script.

Also note that the traditional Unix way by default is to add the UMASK to /etc/profile , and this will also work. But this is not the recommended way to configure such things on Ubuntu, because it is difficult to manage the reliable use of scripts and graphical interfaces.

Answer 3

To comply with group rights, the set gid bit (one of the “sticky bits”) on the server can be considered as an additional option.

If the shared directory is associated with a group, starting (using root): chmod -R 2775 folder_for_the_group can be interesting.

For any new file created in the folder, the creator will be the owner, but the group will be automatically specified (as long as the creator is part of the group).

grid "p> Edit" now displays as -rwxrwsr-x +