I have an http daemon server process (yaws) that I would like to have server write any new files with a umask of 002, so that another user in the same group can modify, move, or delete files created by the daemon process. This is on Ubuntu 10.04.

Unlike Apache, yaws does not have a configuration option for umask, so what methods are there for setting the umask of any daemon process?

I found this answer about changing the init script to add umask 002. This did work, but I'm not sure editing the init script is the best way of making this easy to document and configure on multiple machines.

I also found reference to the pam_umask module here. It looks like this allows per user settings of the umask to be configured in the GECOS field of /etc/passwd.

Are there any other ways to set the umask for daemon processes? And what would be the recommended way?

3 Answers 3


Create a .profile file in the daemon's home directory:

umask 002

You can find the daemon's home directory by running:

getent passwd daemon | awk -F':' '{ print $6; }'

If that doesn't work, the only other solution I can think of would be to edit the /etc/init.d script.

  • 2
    getent passwd daemon | awk -F':' { print $6; } works too. Aug 2, 2010 at 10:34
  • 1
    There's no need to use sudo to read /etc/passwd. Or cat for that matter (grep will accept a filename as an argument or just use getent as Janne pointed out). Aug 2, 2010 at 10:51
  • This does not work under Ubuntu 10.04. This might be because /bin/sh is linked to /bin/dash, but I changed the daemons default shell to /bin/bash and still did not work. I think this is because $HOME/.profile does not get read by non-interactive and non-login bash or dash shells. I could not find any easy way to demonstrate this from the command line. Interactive shell umask can be shown with sudo -u daemon bash -c umask. I tested non-interactive by changing settings and restarting the daemon and looking at permissions on files it creates.
    – mp3foley
    Aug 3, 2010 at 0:18
  • @mp3foley: I'm not familiar with dash, but umask should work in it.
    – Zaz
    Aug 3, 2010 at 11:40
  • I have also asked question on the daemons (yaws) mailing list. The best way is to add the umask setting in the daemon startup script in /etc/init.d/. Someone is even patching the daemons source code.
    – mp3foley
    Aug 6, 2010 at 3:21

On Ubuntu 10.04 global default umask settings can be controlled with the pam_umask module.

Some details were found on this blog related to Debian in general: http://muzso.hu/2008/01/22/default-permissions-with-libpam-umask

The pam_umask module is installed by default on Ubuntu 10.04, but needs to be configured.

Edit /etc/pam.d/common-session, adding the line:

session optional pam_umask.so umask=022

Then per user settings can be changed by running the command:

sudo chfn -o "umask=002" daemon_username

to add a umask setting to the GECOS field in /etc/passwd.

This only works for non-interactive, non-login shells such as when a daemon startup script is run at boot.

For login shells umask settings need to be removed from other shell configuration files such as /etc/profile, /etc/login.defs, or users home directory .profile, .bashrc, etc. Otherwise the pam_umask settings are overridden. See the pam_umask man page for the configuration order.


If the service is started via the tool "start-stop-daemon" the umask can be specified at command line level with the parameter "--umask" e.g:

log_daemon_msg "Starting $DESC" "$NAME"
if start-stop-daemon --start --oknodo --exec $DAEMON -b --chuid motion --umask 002 ; then
        log_end_msg 0
        log_end_msg 1

Adjusting the start-script to read such details from an configuration file might be more transparent than adding user based settings - this of course depends on the startup procedure used for the daemon.

More information can be retrieved from the man-Page: man start-stop-daemon

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .