Is there any security concerns if the umask is set to 027 for root (Basically I want to know if 027 is better in security than 022 ) ?

As per my understanding 027 is a better one from security perspective . But I want to confirm this point .


027 is better from security perspective.

Even better is to use 077 for root.

With 027 mask, when root creates a file, it can be read and executed by users who belongs to the group of the file.

With 077 mask, only root can read write and execute files.

Why is 077 better?

  • because by making files belonging to user readeable by root only, it avoids some common system administrator mistakes.
  • because it's harder for an attacker to run privilege escalation only poorly written shell scripts/binaries if they can't even read it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.