Files permissions FAQ

Umask (User Mask)

What is umask?
Umask (User Mask) defines the default permissions for newly created files and directories by setting access restrictions, rather than granting access (unlike chmod). It plays a key role in controlling access and protecting sensitive data from unintended exposure.

How can I check my current umask setting?
Run the umask command :

## for octal representation:
> umask
0022

## for symbolic representation:
> umask -S
u=rwx,g=rx,o=rx

What do the values in umask (e.g., 0022, 0027) mean?
Umask subtracts permissions from the default (full permissions). The default permissions for new files and directories are calculated as follows:
- File permissions = 666 - umask
- Directory permissions = 777 - umask
For example, when umask is set to 0022:
- Files permissions become : 666 - 022 = 644
- Directories permissions become : 777 - 022 = 755
What is the default umask on LUCIA ?
The default umask is 0002.
How can I temporarily change my umask setting?
Run the umask command with the desired value:
```
> umask 0027  
```
This change lasts for the current session only.
How do I permanently change my umask ?
Add the desired umask command to your ~/.bashrc file:
```
> echo "umask 0027" >> ~/.bashrc  
```
Why might a restrictive umask cause issues in project directories?
A restrictive umask (e.g., 0077) can prevent collaborators in a shared project directory from accessing your files. Adjusting permissions with chmod may be necessary for collaboration.

Setgid (Set Group ID)

What is the purpose of the setgid bit on directories?
The setgid (Set Group ID) bit ensures that any new files or directories created within a directory inherit the group ownership of that directory rather than the primary group of the user who created them. This is particularly useful for collaborative environments to maintain consistent group ownership.
How does the setgid bit ensure files inherit group ownership?
When the setgid bit is applied to a directory, it forces all new files and subdirectories to have the same group as the parent directory. This behavior is enforced at the file system level.
Can the setgid bit affect file collaboration in project directories?
Yes, the setgid bit simplifies collaboration by ensuring all files created in the directory are group-owned, avoiding manual changes to file permissions or ownership.
What tools can I use to verify if the setgid bit is set on a directory?
Use the ls -ld command. The presence of an s in the group execute field indicates the setgid bit is set:
```
> ls -ld <directory_name>
```
Why does my project directory show the s in its permissions?
The s in the group permission field (e.g., drwxrws---) indicates that the setgid bit is set on the directory. This ensures new files and subdirectories inherit the group's ownership.
How can I set the setgid bit on a directory?
Use the chmod command with the g+s option:
```
> chmod g+s <directory_name>
```
How can I remove the setgid bit from a directory?
Use the chmod command with the g-s option:
```
> chmod g-s <directory_name>
```
What happens if I mistakenly apply the setgid bit to files?
If the setgid bit is applied to files, it has no practical effect for most file types but can lead to confusion. For executables, it can allow processes to run with the group permissions of the file, which may pose security risks.
What are the security risks of misconfiguring the setgid bit?
Applying the setgid bit to executables can allow users to run processes with group-level privileges, leading to unauthorized access or privilege escalation.
How can I prevent group members from unintentionally modifying files in a setgid directory?
Restrict group write access with:
```
> chmod g-w <file>
```
Alternatively, set a restrictive umask to control default permissions for new files.
How can I temporarily work under a specific group for file creation?
Use the newgrp command to switch to the desired group temporarily:
```
newgrp project01
```
This ensures new files and directories inherit the active group's ownership. Use id to verify:
```
id
uid=xxxx(user) gid=xxxx(project01) groups=xxxx(project01),xxxx(user)
```

Umask and Setgid Interactions

Can umask settings override the group ownership set by the setgid bit?
No, umask settings do not override the group ownership enforced by the setgid bit. The setgid bit ensures that new files and directories inherit the group ownership of the parent directory, regardless of the umask setting.
How do umask and the setgid bit interact?
The setgid bit and umask settings work together when creating new files or directories:
- The setgid bit enforces the group ownership, ensuring that all new files and directories inherit the group of the parent directory.
- The umask setting determines the default permissions (read, write, execute) for the new files or directories. If the umask is restrictive (e.g., 0077), it may prevent other users in the group from accessing the files, even if they inherit the correct group ownership. To allow group collaboration, you may need to adjust the umask or modify file permissions manually.