3.4.2.3. The file mask
When a new file is saved somewhere, it is first subjected to the
standard security procedure. Files without permissions don't exist
on Linux. The standard file permission is determined by the
mask for new file creation. The value of this mask can be
displayed using the umask command:
Instead of adding the symbolic values to each other, as with
chmod, for calculating the permission on a
new file they need to be subtracted from the total possible access
rights. In the example above, however, we see 4 values displayed,
yet there are only 3 permission categories: user,
group and other. The first zero is part of the
special file attributes settings, which we will discuss in
Section 3.4.2.4 and
Section 4.1.6. It might just as
well be that this first zero is not displayed on your system when
entering the umask command, and that you
only see 3 numbers representing the default file creation mask.
Each UNIX-like system has a system function for creating new
files, which is called each time a user uses a program that creates
new files, for instance, when downloading a file from the Internet,
when saving a new text document and so on. This function creates
both new files and new directories. Full read, write and execute
permission is granted to everybody when creating a new directory.
When creating a new file, this function will grant read and write
permissions for everybody, but set execute permissions to none for
all user categories. This, before the mask is applied, a directory
has permissions 777 or rwxrwxrwx, a plain file
666 or rw-rw-rw-.
The umask value is subtracted from these default
permissions after the function has created the new file or
directory. Thus, a directory will have permissions of 775
by default, a file 664, if the mask value is
(0)002. This is demonstrated in the example below:
bert:~> mkdir newdir
bert:~> ls -ld newdir
drwxrwxr-x 2 bert bert 4096 Feb 28 13:45 newdir/
bert:~> touch newfile
bert:~> ls -l newfile
-rw-rw-r-- 1 bert bert 0 Feb 28 13:52 newfile
|
If you log in to another group using the newgrp command, the mask remains unchanged. Thus, if
it is set to 002, files and directories that you create
while being in the new group will also be accessible to the other
members of that group; you don't have to use chmod.
The root user usually has stricter default file
creation permissions:
[root@estoban root]# umask
022
|
These defaults are set system-wide in the shell resource
configuration files, for instance /etc/bashrc or /etc/profile. You can change them in your own shell
configuration file, see
Chapter 7 on
customizing your shell environment.
