How to set umask globally?

Question

I am using a private user group setup, i.e. a user foo's home directory is owned by foo:foo, not foo:users.

For this to work, I need to set the umask to 002 globally.

After a quick grep -RIi umask /etc/*, it seemed for a moment that modifying the UMASK entry in /etc/login.defs should do the trick. It does, too -- but only for console logins.

If I log in to my desktop, and open a terminal there, I still get to see the default umask 022. Same goes for files created from apps started through the menu. Apparently, the display manager (or whatever X11 component responsible) does source some different setting than a console login does, and damned if I could tell which one it is. (I tried changing the setting in /etc/init.d/rc, and no, it did not help.)

How / where do I set umask globally (and for all users), so that the X11 desktop environment gets the memo as well?

(The system is Linux Mint / Ubuntu, in case that changes anything...)

Solution

You can set the umask globally by introducing the statement

 umask 022

(for instance) in either /etc/profile or /etc/bashrc.

Alternatively, since you are on a Debian system, you may use PAM. To enable this, first edit the file /etc/pam.d/common-session and add the line:

 session optional pam_umask.so

then edit the file /etc/login.defs and add (or modify, whatever) the line

 UMASK           002

These settings are enforced after the next reboot, but be careful: both methods lead to a configuration that can always be superseded by users' choice in their own ~/.bashrc, for instance.

If you are really keen on making it impossible to change the umask, you may use the disk configuration in /etc/fstab. As you know, the available options and syntax depend upon the filesystem type.

Comments

[DevSolar]

I was under the impression that /etc/profile wouldn't do for X11, as it would be only sourced by the appropriate shell environments. Since this answer did work for me, seems I was wrong. ;-) The file I actually ended up editing (as I'm running a Linux Mint / Ubuntu) was /etc/profile.d/umask, which is sourced by /etc/profile (and results in my edits not getting nuked with the next system update of the latter). Thanks!

[DJCrashdummy]

@DevSolar maybe i'm a little bit nitpicking, but i'm pretty sure it has to be a file called umask.sh or whatever.sh because of the line for i in /etc/profile.d/*.sh; do in /etc/profile.