24

For some obvious reasons I need to set umask value for one specific folder. How can one do that?

Thanks beforehand!

UPDATE 1

The reason I need to use umask for a specific folder is following. I have a web application and when it creates some file the default permission is 700. But I need at least 755 permission for that file. I think I could explain the problem more clearly now.

  • 1
    The reasons might be obvious to you, but not to us. Please share what you want to do. – htorque May 22 '11 at 20:12
  • @htorque. Added the reason why I need to use umask in my specific problem. – Bakhtiyor May 22 '11 at 20:24
31

you could use setfacl

setfacl -d -m group:name:rwx /path/to/your/dir

Where name is the group name

To find which groups you or a specific user belong see In unix/linux how do you find out what group a given user is in via command line?

  • 1
    Perhaps setfacl has changed. I am getting an error stating that -m is not a valid option. – Ryan Burnette Jan 10 '15 at 19:51
  • Ryan, setfacl is not changed. Most likely you have't provided proper group name (after -m). – sergk Feb 4 '15 at 3:10
  • 1
    pretty sure setfacl is for access control lists and not umask. A better solution but not actually what was asked, I don't think. – Wyatt8740 Feb 11 '16 at 0:05
  • try: sudo setfacl -Rdm ... (Omit the R for recursion) should work. @Wyatt8740 (correct). To be certain run: man setfacl, and type /-modify. You need to use sudo. – JREAM Feb 27 '19 at 19:17
11

You cannot set umask per directory, it's a process-level value. If you need to prevent others from reading files in a directory, revoke the corresponding permissions bits.

For example, if you've a directory /home/user/directory with some files and directories which can get permissions like 777 from a process, set the permission bits of /home/user/directory to something like 700. That will make it impossible for other users (excluding the superuser root) to descend in /home/user/directory.

I'm paranoid and set the permissions on /home/user to 750, so only I can read, write and descend in my home directory. This has as consequence that folders like /home/user/Public cannot be accessed by others, but I can live with that.


Per update of your question: still, you cannot control that in the filesystem (other than using a different filesystem type like FAT which is strongly discougared), you need to do that in your webapp. If your webapp is coded in PHP, you can change the umask on the fly using the umask function:

<?php
umask(0022);
// other code
?>

You could put this in a configuration file, like the file containing the database connection password (thinking in apps like Wordpress).

Remember that it's a process value, some webservers allow you to set it in their configuration files, otherwise you could modify the startup scripts to set the desired umask. Remember that permissions like 755 and 644 are quite dangerous for webapps, if the code is sensitive, everyone can read it.

  • I know this is ancient, but I figure it's worth mentioning: the administrator can bind mount /home/user/Public (mount -o bind /home/user/Public /some/other/place) to work around the parent directory permissions issue. – Adrian Günter May 8 '18 at 15:52
1

To change permissions for a folder use chmod. umask is for files.

Set umask to what you need by

umask xxx

and change back when your done

umask 022
  • 11
    umask = files and directories, fmask = only files, dmask = only directories. :P – htorque May 22 '11 at 20:15
  • 1
    I learned something new today :) – wojox May 22 '11 at 20:23
  • 1
    Actually that are options for certain file systems like NTFS (not that file creation mask setting command umask). Sorry for adding confusing information. – htorque May 22 '11 at 20:54
  • umask changes the file-creation mask for the current process (the current shell), if you have a different shell open or user-owned process, I don't believe it will be affected. This command will also affect any other files created outside of the directory until you change it back. – Dave May 3 '17 at 14:57
1

Another solution might be to just set the group id on files created in the directory, which makes the new files owned by the directory group id, instead of the group id of the user that created the files. So I think you could just do:

chown www-data:www-data /my/folder

chmod 4755 /my/folder

This sets the setgid special file permission, which would cause all files created in /my/folder to be owned by the www-data group, which has then has rx (5) permission because of the parent directory.

  • 2
    You have mistaken the GUID for the SUID octal value – adampski Jan 23 '18 at 21:44
1

Provide anther solution implemented with shell hooks and direnv. The following solution may be more compatible in case setfacl is not available on your system. (e.g. macOS)

direnv is an environment switcher for the shell. It knows how to hook into bash, zsh, tcsh, fish shell and elvish to load or unload environment variables depending on the current directory.

Use .envrc to export custom umask value for specific dir, and the exported env var will be unloaded when you leave that dir.

# example .envrc file
export UMASK=0022

Define a hook to change the umask value once working dir is changed.

function _umask_hook {
  if [[ -n $UMASK ]]; then
    umask "$UMASK"
  elif [[ $OSTYPE == darwin* ]]; then
    umask 0077
  else
    umask 0022
  fi
}

# To make the code more reliable on detecting the default umask
function _umask_hook {
  # Record the default umask value on the 1st run
  [[ -z $DEFAULT_UMASK ]] && export DEFAULT_UMASK="$(builtin umask)"

  if [[ -n $UMASK ]]; then
    umask "$UMASK"
  else
    umask "$DEFAULT_UMASK"
  fi
}

# zsh hooks
# trigger _umask_hook once working dir is changed
add-zsh-hook chpwd _umask_hook

# bash
# Append `;` if PROMPT_COMMAND is not empty
PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND;}_umask_hook"

For the time being, direnv hook initialization for zsh doesn't support chpwd hook. If the pull request GH-514 has not been merged when you see this page. Please comment out eval "$(direnv hook zsh)" and hook direnv on chpwd manually with following code,

if (( $+commands[direnv] )) && ! (( $+functions[_direnv_hook] )); then
  _direnv_hook() {
    eval "$(command "direnv" export zsh)";
  }
  typeset -agU precmd_functions;
  if [[ -z ${precmd_functions[(r)_direnv_hook]} ]]; then
    precmd_functions=( _direnv_hook ${precmd_functions[@]} )
  fi

  typeset -agU chpwd_functions;
  if [[ -z ${chpwd_functions[(r)_direnv_hook]} ]]; then
    chpwd_functions=( _direnv_hook ${chpwd_functions[@]} )
  fi
fi

Source: dynamic-umask-based-on-cwd.md

0

Related, but maybe not applicable in this case, the following clip is from .zshrc:

# Change the umask automatically for some directories; use 0022 as the default
chpwd () {
    case $PWD in
        $HOME/[Dd]ocuments*)
            if [[ $(umask) -ne 077 ]]; then
                umask 0077
                echo -e "\033[01;32mumask: private \033[m"
            fi;;
        */[Ww]eb*)
            if [[ $(umask) -ne 072 ]]; then
                umask 0072
                echo -e "\033[01;33mumask: other readable \033[m"
            fi;;
        /vol/nothing)
            if [[ $(umask) -ne 002 ]]; then
                umask 0002
                echo -e "\033[01;35mumask: group writable \033[m"
            fi;;
        *)
            if [[ $(umask) -ne 022 ]]; then
                umask 0022
                echo -e "\033[01;31mumask: world readable \033[m"
            fi;;
    esac
}

So for interactive use, something like that would work (but, obviously, not to provide security).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.