9.c Manage default file permissions
...

This topic includes:

System base file permissions
Change default file permissions
Inspect file permissions

commands

umask
ls
stat

System file permission defaults.
...

By default, files in Linux have octal permissions of 0666 and folders have permissions of 0777.

These defaults are quite permissive and some permissions are often subtracted for better security.

📝 NOTE: Folders are granted execute permissions by default because without this, users cannot cd into them. Execute permissions on files must be granted manually.

Permissions can be automatically subtracted by configuring a umask. Most Linux systems, including RHEL, come pre-configured with a umask which can be viewed from the terminal.


1
umask
2
# 0002

The umask subtracts from the base permissions as shown in this diagram:

📝 NOTE: The default mask for a standard user is 0002; for the root user it is 0022.

Change default file permissions
...

To changing the default file permissions is as simple as changing the umask. This can be done non-persistently by writing the octal value after the command:


1
umask 0077
2
umask
3
# 0077

⚠️ WARNING: Changing the umask as above does not persist on reboot, or even on opening a new shell.

To always change the default umask for a user, you can add the command into their .bashrc:


1
echo 'umask 0077' >> /home/user/.bashrc

To change system-wide umask default, edit /etc/login.defs


1
vim /etc/login.defs
2
##
3
# ERASECHAR       0177
4
# KILLCHAR        025
5
# UMASK           022 -> 025
6
## 
7
:wq
8

9
/bin/bash
10

11
umask 
12
0025

📝 NOTE: umask can only reduce default permissions, not increase them. Because of this, special permissions are not really affected by umask since they have a value of 0 by default.

Inspect file permissions
...

To confirm whether files made with a umask have the desired permissions, ls -l can show symbolic permissions and octal permissions can be viewed using stat.


1
umask 0077
2
touch file
3
stat file
4

5
# File: file
6
# Size: 0         	Blocks: 0          IO Block: 4096   regular empty file
7
# Device: 803h/2051d	Inode: 28968428    Links: 1
8
# Access: (0600/-rw-------)  Uid: ( 1000/      user)   Gid: ( 1000/      user)

⬅️ Back

9.c Manage default file permissions...

System file permission defaults....

Change default file permissions...

Inspect file permissions...

9.c Manage default file permissions
...

System file permission defaults.
...

Change default file permissions
...

Inspect file permissions
...