topic Re: umask in Operating System - HP-UX

umask

Chakravarthi — Mon, 02 Dec 2002 13:28:18 GMT

Hi all,

My requirement is like this,

I set umask to 022 in /etc/profile, and this value should not be changed by any user. basically, the system values can be changed by users, but umask value should not change even the user has mentioned some other value in profile.

How to accomplish this

regards
chakri

Re: umask

Ravi_8 — Mon, 02 Dec 2002 13:12:37 GMT

Hi,

you can't.
users can override the umask value set by system using umask

Re: umask

Jean-Louis Phelix — Mon, 02 Dec 2002 13:30:27 GMT

Hi,

It's really not possible. Even Pete's solution that I thought to be the only way to do it can't work (or at least it's quite harder) because umask is also a builtin command. So even after renaming /usr/bin/umask, I can still change it.

Regards.

Re: umask

Armin Feller — Mon, 02 Dec 2002 13:31:52 GMT

Hi,

perhaps you can set the umask in /etc/profile for all useres, so the user is not able to change this.

Regards,
Armin

Re: umask

Chakravarthi — Mon, 02 Dec 2002 13:33:15 GMT

User can change it at the command line or in his profile, because

first the system profile and then the user profile will get executed, so it'll override system parameters,

the user can change it anytime

Re: umask

Pete Randall — Mon, 02 Dec 2002 13:34:30 GMT

Chakri,

Short of renaming or removing or changing the permissions on the actual umask command (or perhaps creating an alias for every user that would point to a dummy umask that actually does nothing), you really can't prevent them from using umask.

Pete

Re: umask

Jean-Louis Phelix — Mon, 02 Dec 2002 14:03:39 GMT

Yeeeaaaah ... I gave my answer 5 minutes before reading Pete's one ... but I'm speaking about it ! Return to future ...

Re: umask

Chakravarthi — Tue, 03 Dec 2002 05:09:34 GMT

or can i have a cronjob running on my machine which checks the umask every time for all the users, if any change happens it'll set it to the default umask which is set in /etc/profile

Re: umask

Michael Tully — Tue, 03 Dec 2002 05:52:15 GMT

The biggest problem you face is where are you going to look to change a users umask. There are a number of places (~user/.profile, ~user/.login) and any little env file they happen to have laying around, and of course if they have shell access, it is a little bit hard stop unless you change the execute permissions for umask itself. I wouldn't do this, as there may be some exexcutable that could attempt to use 'umask' to create files.

Re: umask

F. X. de Montgolfier — Mon, 09 Dec 2002 14:57:06 GMT

Hi,

I can think of one way to ensure that people who use umask know they shouldn't:

Alias umask to umask -S in the /etc/profile. This way, when somebody tries setting up an umask, he won't be able to.
Someone who _really_ wants to change his umask is able to, though; he just has to unalias umask...

It's not a very nice solution (root also has to unalias umask if he wants to use it), but it's the only one I can think of...

Cheers,

Fran??ois-Xavier

Re: umask

Dietmar Konermann — Mon, 09 Dec 2002 16:01:16 GMT

As correctly noted before, umask(2) cannot be restricted (just the same is true for chmod(2), BTW). However, it may be a good idea to warn users if they own files that are world-writable.

You can easily get a file list with e.g.:

# find / ! -type l -perm -2 | xargs ls -ld

After some filtering it should be easy to send some mails using a conjob, etc.

Best regards...
Dietmar.