Why could the group write to plan.txt while others could not? The process's mask decided that.
A program that creates a file asks for generous rights: rw-rw-rw- (666) for a file and rwxrwxrwx (777) for a directory. The process's mask, the umask, removes the extra letters. It is written in digits like a mode, except that a digit here means "take away":
| Mask | New file | New directory |
|---|---|---|
002 |
rw-rw-r-- (664) |
rwxrwxr-x (775) |
022 |
rw-r--r-- (644) |
rwxr-xr-x (755) |
umask with no arguments prints your shell's mask: yours is 0002. The leading zero is optional: umask 022 and umask 0022 mean the same.
A process has mask 027. Which mode will a file it creates get?
-
The group digit 2 removes
w:rw-becomesr--. Check it:bash -c 'umask 027; touch m.txt', thenls -l m.txt. -
That is what mask 022 gives. The 7 for others removes all three letters, leaving
---. -
That is what a new directory gets: it starts from 777. A file starts from 666 with no
xfor anyone, and the mask does not add it.
From the requested 666, mask 027 removes w from the group and everything from others, leaving 640, rw-r-----. Check it in a separate shell: bash -c 'umask 027; touch m.txt', then ls -l m.txt.
A process inherits its mask from its parent, just like its groups: umask 022 typed in the terminal holds in that shell until you leave it.
The starting mask comes from logging in: Ubuntu gives 0002 to a user with a personal group. A umask 022 line in ~/.profile changes the mask at login, because the login shell reads that file. sudo -u alice starts no login shell and does not read ~/.profile, while sudo -iu alice does start one, the same way a real login of alice works.
Create a file as alice in two ways
The last line of alice's ~/.profile is umask 022. Create a file in /srv/team as alice with sudo -u and with sudo -iu, then compare them in ls -l.
First, predict
Which mode will ls -l show for a2.txt, the file made by sudo -iu alice?
Now start the exercise, run the command and compare your prediction with the output.