I run apache as user www-data on Ubuntu 10_04 LTS. I've got /etc/apache2/envvar setup with 'umask 002' so that any new files/dirs created by the daemon have group write permissions enabled. At times, I need to create files/dirs from the command line so I do 'sudo -u www-data' commands, but I can't figure out how to get those to enable group write permissions on creation.
In /etc/passwd, Ubuntu's home directory is listed as '/var/www'. So, per the ubuntu documentation (https://help.ubuntu.com/community/EnvironmentVariables), I've tried adding "umask 002" to the following locations:
/var/www/.profile
/var/www/.bashrc
/var/www/.bash_profile
/var/www/bash_login
And the the global environment files:
/etc/environment
/etc/bash.bashrc
Even after adding "umask 002" to all those files and rebooting, running 'sudo -u www-data touch testfile' results in "-rw-r--r--" permissions. (I tried that with the www-data shell set to both /bin/sh and /bin/bash.)
Is there any way to setup so that 'sudo -u www-data' commands will create items with group write permissions enabled?
sudo -u www-data <command>
starts the calling user's shell as a non-interactive non-login shell as user www-data and has it execute<command>
, so – being non-interactive – in general no dotfiles get executed at all. (You can forcesudo
to start the shell as a login shell, which will then execute.profile
among others, by using the option-i
.) So that explains why addingumask 002
to www-data's dotfiles doesn't work.sudo
uses the calling user's umask (with certain restrictions, see the optionsumask
andumask_override
inman sudoers
or the answer below), so that in general<command>
will be executed with that umask. (Again, you can change that by using sudo's-i
option and setting a new umask in www-data's dotfiles.)sudo -u www-data <command>
won't start a new shell at all (unless options-i
or-s
are given). For instance, if it did, www-data's.zshenv
should be executed uponsudo -u www-data <command>
(provided the calling user uses zsh). This is because, as an exception to my statement above,.zshenv
is sourced for every instance of zsh (no matter whether interactive/non-interactive, login/non-login). Here, however, it isn't.sudo -u www-data <command>
simply runs<command>
as user www-data, by usingsetuid()
to change the user of the child process it spawns.