umask hell

17 Sep, 2023

I lost one hour before figuring out that the permissions set on a new conda environment was due to a restrictive umask value: 077 for the root user.

In this case all the directories are created with a permission of 700 and file with 600, meaning only root can access.

The value is set for

• login shells: grep umask /etc/profile
• non-login shells: grep umask /etc/bashrc

Two values are set one for low ID meaning power users like root and the other for standard users.

if [ $UID -gt 199 ] && [ “id -gn” = “id -un” ]; then
  # standard users
  umask 002
else
  # power users  
  umask 022
fi

#linux #security