Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an http daemon server process (yaws) that I would like to have server write any new files with a umask of 002, so that another user in the same group can modify, move, or delete files created by the daemon process. This is on Ubuntu 10.04.

Unlike Apache, yaws does not have a configuration option for umask, so what methods are there for setting the umask of any daemon process?

I found this answer about changing the init script to add umask 002. This did work, but I'm not sure editing the init script is the best way of making this easy to document and configure on multiple machines.

I also found reference to the pam_umask module here. It looks like this allows per user settings of the umask to be configured in the GECOS field of /etc/passwd.

Are there any other ways to set the umask for daemon processes? And what would be the recommended way?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

Create a .profile file in the daemon's home directory:

#!/bin/sh
umask 002

You can find the daemon's home directory by running:

getent passwd daemon | awk -F':' { print $6; }

If that doesn't work, the only other solution I can think of would be to edit the /etc/init.d script.

share|improve this answer
2  
getent passwd daemon | awk -F':' { print $6; } works too. –  Janne Pikkarainen Aug 2 '10 at 10:34
1  
There's no need to use sudo to read /etc/passwd. Or cat for that matter (grep will accept a filename as an argument or just use getent as Janne pointed out). –  Dennis Williamson Aug 2 '10 at 10:51
    
This does not work under Ubuntu 10.04. This might be because /bin/sh is linked to /bin/dash, but I changed the daemons default shell to /bin/bash and still did not work. I think this is because $HOME/.profile does not get read by non-interactive and non-login bash or dash shells. I could not find any easy way to demonstrate this from the command line. Interactive shell umask can be shown with sudo -u daemon bash -c umask. I tested non-interactive by changing settings and restarting the daemon and looking at permissions on files it creates. –  mp3foley Aug 3 '10 at 0:18
    
@Janne Pikkarainen: Thanks, I'll edit my post. –  Josh Aug 3 '10 at 11:28
    
@mp3foley: I'm not familiar with dash, but umask should work in it. –  Josh Aug 3 '10 at 11:40

If the service is started via the tool "start-stop-daemon" the umask can be specified at command line level with the parameter "--umask" e.g:

log_daemon_msg "Starting $DESC" "$NAME"
if start-stop-daemon --start --oknodo --exec $DAEMON -b --chuid motion --umask 002 ; then
        log_end_msg 0
    else
        log_end_msg 1
        RET=1
    fi

Adjusting the start-script to read such details from an configuration file might be more transparent than adding user based settings - this of course depends on the startup procedure used for the daemon.

More information can be retrieved from the man-Page: man start-stop-daemon

share|improve this answer

On Ubuntu 10.04 global default umask settings can be controlled with the pam_umask module.

Some details were found on this blog related to Debian in general: http://muzso.hu/2008/01/22/default-permissions-with-libpam-umask

The pam_umask module is installed by default on Ubuntu 10.04, but needs to be configured.

Edit /etc/pam.d/common-session, adding the line:

session optional pam_umask.so umask=022

Then per user settings can be changed by running the command:

sudo chfn -o "umask=002" daemon_username

to add a umask setting to the GECOS field in /etc/passwd.

This only works for non-interactive, non-login shells such as when a daemon startup script is run at boot.

For login shells umask settings need to be removed from other shell configuration files such as /etc/profile, /etc/login.defs, or users home directory .profile, .bashrc, etc. Otherwise the pam_umask settings are overridden. See the pam_umask man page for the configuration order.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.