Unit 5: Permissions · Lesson 5 of 6 · 14 min
Safe defaults with umask
umask decides the mode of every new file. Set it so secrets start private.
mission
- You are
- You are writing a script that will save audit reports.
- Situation
- Your reports will name weaknesses. You want them private the moment they are created.
- Goal
- See how umask shapes new files and pick a private one for your reports.
- Hand in
- The mode a new file gets under umask 022 and under 077.
How umask works
- Start666 for files, 777 for folders
- Subtract umask022 removes write for group and others
- Result644 files, 755 folders
Read the default
New files start from 666 and folders from 777. umask removes bits from those.
umask 0022 touch a.txt; mkdir b stat -c '%a %A %n' a.txt b 644 -rw-r--r-- a.txt 755 drwxr-xr-x b
you should see 022 removes write for group and others: readable by everyone.
Go private
umask 077 touch c.txt; mkdir d stat -c '%a %A %n' c.txt d 600 -rw------- c.txt 700 drwx------ d
you should see 077 removes everything for group and others. The change lasts until you close the shell.
defender tip Put umask 077 at the top of scripts that write sensitive output.
Where the default comes from
A umask set inside parentheses only lasts for that subshell, which is a handy pattern in scripts.
cat /etc/profile.d/00-umask.sh umask 022 grep -E '^UMASK' /etc/login.defs UMASK 022 (umask 077; touch /tmp/secret.txt) && stat -c '%a %n' /tmp/secret.txt 600 /tmp/secret.txt
you should see 022 by default, 600 for the one private file.
Same touch, different umask
-rw-r--r-- report.txt
Everyone reads your findings
-rw------- report.txt
Only you do
What a defender takes away
- 1umask subtracts bits from 666 and 777.
- 2022 is the usual default, 077 is private.
- 3Set umask in scripts that create sensitive files.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.