Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On my Ubuntu 11.04x64 server, I have service accounts running which do not log in and do not have home directories. These service accounts are responsible for running processes which are invoked as services.

When these services created new files, I need them to be created with the permissions 664 (UMASK 002).

I edited the /etc/profile umask setting to reflect this. I see that now my user account creates files which reflect this new umask setting, but the service accounts do not when I manually created files using their accounts (sudo -u serviceaccount touch newfile).

Any suggestions?

share|improve this question
1  
I've also edited the UMASK setting in /etc/login.defs - but this does not work either. –  nfarrar Aug 4 '11 at 3:21
add comment

1 Answer

If the services are started via Upstart or /etc/init.d, edit the appropriate initscripts.

  • init.d: umask 02 at the top of script (they are ordinary sh scripts)
  • Upstart: umask 0775 anywhere (don't ask why it's inverted)

Linux does not have a strict definition of "login", and an account is merely an UID that can (or cannot) be associated with a name/homedir/etc.

When you log in on console/over SSH, the login program (or the SSH daemon) uses PAM to set up the environment (possibly pam_umask), then starts your shell with the "login" flag. The /etc/profile script belongs to the sh and bash shells, which only read it for "login" invocations.

When you use sudo touch ... or sudo /etc/init.d/foo start, sudo still calls PAM for auth/account/session setup, but does not start the shell at all, meaning all "profile" or "bashrc" files will be ignored. (That is, unless you use sudo -i ....)

When Upstart runs a service, it simply switches the UID to that of your service, skipping any "profile" scripts or PAM configuration. The only configuration that is read is the service's file in /etc/init, which is where you should put the umask setting.

share|improve this answer
1  
Actually it's also umask 002 for upstart, our experiments show. The upstart documentation has a misleading example. –  Bart Schuller Aug 9 '13 at 17:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.