How to set different permissions for directories and files using umask and fuse - fuse

I use fuse to mount some directories on Ubuntu. The user should have rwx on directories and rw- on files.
Now doing this with setfacl is quite easy. Doing setfacl -R -d -m u::rwX,g::rwX,o::--- dir/ does the job perfectly fine.
But how to do this with umask?

What you should know about umask first is that umask is a mask; it is not a number to be subtracted.
It turns off permissions that would normally be granted.
Masking is not the same as subtracting, e.g. 666 masked with 001 is still 666 and 666 masked with 003 is 664.
The mask turns off permission bits. If they are already off, the umask makes no change.
Make sure you are in the directory you wanna assign permissions to and do the following:
this link answers exactly what you're looking for!
https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html
hope this helps.

Related

How to provide permissions to file while creating it using single line UNIX command

I'm currently working on below Unix command which generates a text file with 644 permissions but i have to create with 777 permission. How can we fit in the permission part in the below command?
find /home/temp/{a_File_Data.csv,b_File_Data.csv,c_File_Data.csv,d_File_Data.csv} |xargs -n 1 basename > /home/temp/File_Data.txt
Thanks!
AFAIK, an output redirect will never add the x executable permission, that is for your safety.
But you can get the 666 permissions by setting your umask before your command:
$ umask 000
And you can restore later to the previous value, that seems to be:
$ umask 022

Linux file default permissions

I just set up a apache server on my Raspberry pi. To make the development easier I shared the /var/www/html folder with samba.
I'm able to create new files from my computer in the Pi folder, but they have the following permission :
-rwxrw---- 1 pi pi 52 juin 10 17:54 test.php
With those permissions Apache is not able to read the file.
So each time I need to send the following command to make the file readable by Apache :
chmod a+rwx test.php
Then my permission are :
-rwxrwxrwx 1 pi pi 52 juin 10 17:54 test.php
So ok, after sending this command, it's works... But I am trying to find the command to set up the default file permissions to "-rwxrwxrwx "
I'm new with linux so maybe it's easy to fix.... Do you have any ideas ?
Thanks a lot,
Maxime
Thanks for your answers.
the solution was to change the "create mask" value to 0775 in the smb.conf file.
Maxime
For changing default permissions of the file created, you can use umask command. umask is user mask which is used whenever a new file is created.
umask is a three digit number with octal base. First digit decides the user permissions, second is for group while third determines the permissions for others.
umask value is used in inverted/complemented form though. That means to determine the required umask value for the permissions you want, subtract the permissions (in octal form) from 666. The result should be used as your umask value. e.g. if you want to set default permissions to rw-r--r-- (which is 644 in octal) subtract 644 from 666. The result (022) is your umask value.
To set value for umask you can simply use:
umask 022
command.
For your case here, I think you can use
umask 000
The default umask value is 0022, which decides the default permission for a new file or directory. The default permission for a directory is 0777, for files the permissions are 0666 from which the default umask value 0022 is deducted to get the newly created files or directory permission.

linux umask for sudo and apache

I want to make 002 the system-wide umask for all users (in Ubuntu). I managed to do so for all regular users using the instructions provided by #ephemient (From this post, thanks for that!). However I got 2 more problems.
Firstly, when sudoing, the root user seems to follow it's own settings, making files with the permissions 644 (instead of 664).
Secondly, the apache user (www-data) also seems to follow it's own settings (the same used by root?), making files with the permissions 644 (instead of 664). I don't like to put umask 002 in /etc/apache2/envvars, I'd rather change the setting assigning the 002 umask to apache in the first place.
How can I tackle those last 2 issues?
I solved my own problems.
For the sudo permissions, I executed sudo visudo and added the line Defaults umask = 0002 to the end.
For the Apache user, I added the line umask 0002 to the end of the /etc/apache2/envvars (I couldn't find any better solution).

Linux group permissions?

I was wondering if anyone could explain a bit on Linux permissions for me. I have two groups
Group A - Normal Users
Group B - File Changing group
I want group B to be pretty much exactly the same as group A other than group B are able to change 'message of the day' how could I set it so they have write access to MOTD and group A only have read access?
With ordinary UNIX u-g-o permissions, you can only assign a single UNIX group to any given file. In your case, since "normal users" presumably means "all users", you could just chmod the MOTD file to 664 (group read-write, all read-only), and chown it to root:file_changers (file owned by root, and assigned to the file_changers group).
With Linux ACLs, you can assign multiple groups to a file. Not all filesystems support ACLs. You can use setfacl to alter the permissions:
setfacl -m g:regular:r motd
setfacl -m g:file_changers:rw motd
Note that, in my opinion, ACLs can often be overkill. They can make permission management a hassle if you aren't prepared for them. Consider carefully if you need them; otherwise, stick to the simpler UNIX permission system.
Solution without ACL:s:
You can move the motd file in a directory that is readable by group A and make the file writable by group B. Then place a symlink in place from the original location to the new location.
Example (assuming motd is in /etc/motd):
# mkdir /etc/motd-dir
# mv /etc/motd /etc/motd-dir/
# chown groupA /etc/motd-dir
# chown groupB /etc/motd-dir/motd
# chmod 750 /etc/motd-dir
# chmod 664 /etc/motd-dir/motd
# ln -s /etc/motd-dir/motd /etc/motd
This solution requires that all members of group B must also belong to group A so they can access the directory.

chmod cannot change group permission on Cygwin

I am using Cygwin and trying to change the group access permission with chmod, e.g.
$ls -l id_rsa
-rwxrwxr-- 1 None 1679 Jun 13 10:16 id_rsa
$ chmod g= id_rsa
$ ls -l id_rsa
-rwxrwxr-- 1 None 1679 Jun 13 10:16 id_rsa
But this does not work. I can change permission for user and others. Seems that the permission level for group somehow keeps the same as that of user?
I was having a similar problem to you, and I was using the NTFS filesystem, so Keith Thompson's answer didn't solve it for me.
I changed the file's group owner to the Users group:
chown :Users filename
After doing that I was able to change the group permissions to my will using chmod. In my case, since it was an RSA key for OpenSSH, I did:
chmod 700 filename
And it worked. In Cygwin you get two groups by default, the Root group and the Users group. I wanted to add another group, but I wasn't able to do it with the tools I'm used to use on Linux. For that reason I just used the Users group.
Cygwin doesn't like files to be owned by groups that it doesn't know.
Unfortunately, that happens quite often in Cygwin, especially if your PC is in a Windows domain where things keep changing.
I also synchronise my files between two PCs, via an external drive, and the uids/gids are different between the different PCs, so this is a source of problems.
If you do ls -l and see a numeric group id instead of a group name, it means Cygwin doesn't know the gid - i.e. it's not in /etc/group, and Cygwin can't query it from Windows either. You can confirm this by running getent group <gid>, where <gid> is the numeric group id.
To fix it, you can either use chgrp to change the group for all affected files/directories, as described in the accepted answer above, or create an entry for the unknown gid in /etc/group, with any unused group name (e.g. Users2).
After doing this, it may be necessary to close all of your Cygwin windows and then re-open them.
An experiment shows that chmod does work correctly to change group permissions under Cygwin.
The experiment used a file on an NTFS partition. Cygwin implements a POSIX layer on top of Windows, but it still ultimately uses the features of Windows itself, and of the particular filesystem implementation.
On modern versions of Windows, most hard drives are formatted to use NTFS, which provides enough support for chmod. But external USB drives typically use FAT32, which doesn't have the same abilities to represent permissions. The Cygwin layer fakes POSIX semantics as well as it can, but there's only so much it can do.
Try
$ df -T .
If it indicates that you're using a FAT32 filesystem, that's probably the problem. The solution would be to store the file on an NTFS filesystem instead. A file named id_dsa is probably an SSH private key, and it needs to be stored in $HOME/.ssh anyway.
Is your home directory on a FAT32 partition? As I recall, recent versions of Windows ("recent" meaning the last 10 or more years) are able to convert FAT32 filesystems to NTFS.
The remainder of this answer was in response to the original version of the question, which had a typo in the chmod command.
Cygwin uses the GNU Coreutils version of chmod. This,
chmod g=0 fileName
is not the correct syntax. I get:
$ chmod g=0 fileName
chmod: invalid mode: `g=0'
Try `chmod --help' for more information.
(This is on Linux, not Cygwin, but it should be the same.)
To turn off all group permissions, this should work:
$ chmod g= fileName
$ ls -l fileName
-rw----r-- 1 kst kst 0 Jun 13 10:31 fileName
To see the chmod documentation:
$ info coreutils chmod
To see the documentation on symbolic file mode:
$ info coreutils Symbolic
The format of symbolic modes is:
[ugoa...][+-=]PERMS...[,...]
where PERMS is either zero or more letters from the set 'rwxXst', or a
single letter from the set 'ugo'.
Like previous answers, not recognized groups cause such issues. It mostly happens in Windows Domains.
The easiest way to fix it is regenerate your /etc/passwd and /etc/group files (parameter -d is needed for domain users):
mkpasswd -l -d > /etc/passwd
mkgroup -l -d > /etc/group
Close and launch Cygwin again.
This is a very annoying issue for me. In my case user135348's solution worked best. The biggest issue with the chown :Users -R approach is that every time a new file is created, it will be assigned to the unknown gid 1049120. It's very frustrating to keep changing file gid.
I tried mkgroup too, but in my case it didn't work: My gid is 1049120.
Based on the rules explained in Mapping Windows SIDs to POSIX uid/gid values : : 0x100000 offset is used for account from the machine's primary domain.
Trying to remove the same offset from 1049120, you get 544, which is built-in Administrators group's RID.
This account is not a member of the local Administrators group; we use SuRun to grant administrator rights without giving out credentials. In this case, mkgroup failed to generate all the possible gids.
Editing the group file and adding a customized group name seems always to fix the issue easily.
I had this issue when working remotely from the Domain and using cygserver.
Running ls -l showed a numeric group id instead of a group name.
I stopped cygserver, net stop "CYGWIN cygserver, and other Cygwin processes, then ran the ls -l again, and group names were then displayed correctly.
I guess cygserver was holding incomplete domain group information.
After restarting cygserver the system continued to work correctly.
#!/bin/bash
find . |while read obj; do
if [[ -d "$obj" ]]; then
setfacl --set "user::rwx,group::r-x,other::r-x" "${obj}"
elif [[ -f "$obj" ]]; then
setfacl --set "user::rw-,group::r--,other::r--" "${obj}"
fi
done
You must specify the group name on the Windows system which your user belongs to.
So I just did this:
chown -R ONEX:Users ~/*
You can find your user name and group here:

Resources