default umask for cron

[Luis Toro]

I will be changing the umask setting in /etc/profile to be more restrictive. In running some simple tests in cron, to test the impact of this change, I noticed that even though umask was set to 027 in /etc/profile, new file permissions were rw-r--r-- in running a "touch" command in roots cron. This is on an HPUX server.
Thanks

[Patrick Wallek]

Cron does NOT source any profiles, /etc/profile or ~/.profile.

If you want a specific umask in your cron scripts you need to set it manually in the scripts themselves.

[Luis Toro]

Thanks Patrick.
Perhaps the better question is: where is cron getting its umask?

[Dennis Handly]

>Perhaps the better question is: where is cron getting its umask?

You should just set umask the way you want it in your scripts as Patrick said.

Otherwise cron is started from rc, which is started from inittab.

[Kapil Jha]

I think i got your question,
Patrick is absolutely right when he says cron does not refer any .profile file,you have to put in cron script.

Dennis
>Otherwise cron is started from rc, which is started from inittab

Lis question is if he is running touch from cron entry file has permission 644.
So from where this permission is coming.

I think its the default one 022 as said by Dennis.Cron start from rc.
When u change umask for root or someone from .profile it would be effective only for that login.
BR,
Kapil

[Kapil Jha]

Now m confused with your error , default mask should come from /etc/profile(global)
and I think cron should take default from this only.
Can you please check once again entries you have in /etc/profile.
BR,
Kapil

[Dennis Handly]

>Kapil: Now I'm confused with your error

Why? You said exactly what umask was, 022. This is hardcoded in /sbin/rc.
And that matches with what Luis said touch did.

>default mask should come from /etc/profile

But it gets reset by rc(1m).

>I think cron should take default from this only.

No, cron gets it from rc.

[Kapil Jha]

So it moves like
rc > /etc/profile > HOME/.profile

if /etc/profile and HOME/.profile does not have any specified umask then default would come from rc.
Right...

Kapil

[Dennis Handly]

>Kapil: So it moves like
>rc > /etc/profile > HOME/.profile

Why?

It moves like: maybe /etc/profile > HOME/.profile
rc > umask 022 > /sbin/rc.utils, rc.config
>> rc scripts

>if /etc/profile and HOME/.profile

Why would these be looked at after rc starts?

[OldSchool]

Kapil:
"if /etc/profile and HOME/.profile does not have any specified umask then default would come from rc.
Right..."

and cron *doesn't* login, so it doesn't use the profiles....which is why its set to the default....

[Luis Toro]

Thanks for the replies. I know that you can and should source in things like umask in cron entries. The reason for my question is that I need to make the default umask in /etc/profile 027 for every server (audit). And I wanted to make sure that in doing so, I would not impact those cron entries (and there are a lot) from lazy application groups ;-) that do not source in anything.
So it would seem that making the change in /etc/profile would not imnpact cron jobs. Now the admin in me wants to provide further comfort to the app teams, and state that the cron umask is controlled by [fill in answer here]. I thought /sbin/rc was it, but I changed it on a test server, rebooted, and my "test touch" entry still had 022 (rw-r--r--) (yes, I removed the file prior to the test). I started researching the .proto file in /var/adm/cron, but the umask there is a variable ($m). 10 points for the answer.

[James R. Ferguson]

Hi Luis:

Yes, see the 'proto(4)' manpages for more details.

You can alter the 'cron' or 'at' task's umask as demonstrated below. In these cases, I let the output be mailed to the account originator:

# cat /tmp/mything
#/usr/bin/sh
echo ok
umask

# umask 077;at -f /tmp/mything 1236

[mail result was]
ok
077

# crontab -l
37 * * * * umask 077 && /tmp/mything

[mail result was]
ok
077

Regards!

...JRF...

[Dennis Handly]

>but I changed it on a test server, rebooted, and my "test touch" entry still had 022

Ah, it is hardcoded in cron(1).

>JRF: see the 'proto(4)' manpages for more details.

It seems proto(4) is only for at/batch.