RHCSA Rapid Track

Add the setgid bit on the example directory by using the symbolic method:

[user@host ~]# chmod g+s example

Remove the setuid bit on the example directory by using the symbolic method:

[user@host ~]# chmod u-s example

Set the setgid bit and add read, write, and execute permissions for user and group, with no access for others, on the example directory by using the octal method:

[user@host ~]# chmod 2770 example

Remove the setgid bit and add read, write, and execute permissions for user and group, with no access for others, on the example directory by using the octal method. Note that you need to add an extra 0 at the beginning of the permissions value when removing special permissions by using the octal method:

[user@host ~]# chmod 00770 example

The following example explains how the umask affects the permissions of files and directories. Look at the default umask permissions for both files and directories in the current shell.

If you create a regular file, then its initial octal permissions are 0666 (000 110 110 110, in binary representation). Then, the 0022 umask (000 000 010 010) disables the write permission bit for group and others. Thus, the owner has both read and write permission on files, and both group and other are set to read (000 110 100 100).

Figure 4.2: Example of umask calculation on a file

[user@host ~]$ umask
0022
[user@host ~]$ touch default.txt
[user@host ~]$ ls -l default.txt
-rw-r--r--. 1 user user 0 May  9 01:54 default.txt

If you create a directory, then its initial octal permissions are 0777 (000 111 111 111). Then, the 0022 umask (000 000 010 010) disables the write permission bit for group and other. Thus, the owner has read, write, and execute permissions on directories, and both group and other are set for read and execution (000 111 101 101).

Figure 4.3: Example of umask calculation on a directory

[user@host ~]$ umask
0022
[user@host ~]$ mkdir default
[user@host ~]$ ls -ld default
drwxr-xr-x. 2 user user 0 May  9 01:54 default

By setting the umask value to 0, the file permissions for other change from read to read and write. The directory permissions for other change from read and execute to read, write, and execute.

[user@host ~]$ umask 0
[user@host ~]$ touch zero.txt
[user@host ~]$ ls -l zero.txt
-rw-rw-rw-. 1 user user 0 May  9 01:54 zero.txt
[user@host ~]$ mkdir zero
[user@host ~]$ ls -ld zero
drwxrwxrwx. 2 user user 0 May  9 01:54 zero

To mask all file and directory permissions for other, set the umask value to 007.

[user@host ~]$ umask 007
[user@host ~]$ touch seven.txt
[user@host ~]$ ls -l seven.txt
-rw-rw----. 1 user user 0 May  9 01:55 seven.txt
[user@host ~]$ mkdir seven
[user@host ~]$ ls -ld seven
drwxrwx---. 2 user user 0 May  9 01:54 seven

A umask of 027 ensures that new files have read and write permissions for user and read permission for group. New directories have read and execute permissions for group and no permissions for other.

[user@host ~]$ umask 027
[user@host ~]$ touch two-seven.txt
[user@host ~]$ ls -l two-seven.txt
-rw-r-----. 1 user user 0 May  9 01:55 two-seven.txt
[user@host ~]$ mkdir two-seven
[user@host ~]$ ls -ld two-seven
drwxr-x---. 2 user user 0 May  9 01:54 two-seven

In Red Hat Enterprise Linux 9, the /etc/login.defs file sets the default umask for users. By default, its UMASK line specifies that the default umask is 0022.

In Red Hat Enterprise Linux 9.0 and 9.1, this file affects only login shells. If you start a new terminal window or start an interactive non-login shell in some other way, then settings in /etc/bashrc still apply. For these shells, if the account's UID is 200 or greater and the username and primary group name are the same, then the account is assigned a umask of 0002. Otherwise, the umask is 0022.

The root user can change the default umask for interactive non-login shells by adding a local-umask.sh shell startup script in the /etc/profile.d/ directory. The following example shows a local-umask.sh file:

[root@host ~]# cat /etc/profile.d/local-umask.sh
# Overrides default umask configuration asda sda
if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
    umask 007
else
    umask 022
fi

The preceding example sets the umask to 0007 for users with a UID greater than 199 and with a username and primary group name that match, and to 0022 for everyone else. (Leading zeros can be omitted.) To set the umask to 0022 for everyone, then create that file with the following content:

# Overrides default umask configuration
umask 022

The current umask of a shell applies until you log out of the shell and log back in, or until you change it manually with the umask command.