umask per dir

[Moderator, John Quarterman]

Date: Thu, 6 Feb 86 06:06:25 EST
>From: Alex Dupuy <dupuy%garfield at COLUMBIA.EDU>

Organization: Columbia University

In <4103 at ut-sally.UUCP> std-unix at ut-sally.UUCP (John Quarterman) writes:
> 
> The more interesting question is *how* do you set a umask on a directory?  Do
> you try to derive the bits from the directory mode bits in some way? ...  And
> how do you get the umask inherited by child directories?
> 
> I would think the preferred approach would be to somehow derive the umask
> from the directory mode bits.  Inheriting could be done by just setting the
> umask for all the subdirectories with find.  Except that mkdir should likely
> make sure the umask were inherited.

Having primarily used bsd Unix for a few years, and before that, Twenex, which
has default file protections on a per-directory basis, I would agree that
keeping the protection masks in the directory tree is better than the Unix's
umask.  Still, as some have pointed out, for reasons of compatibility with tar
and cpio, adding information to the directory structures would be a mistake.
Also, switching over to a purely directory based umask would cause security
problems with existing programs expecting umask to work properly.

A directory/process based umask scheme which provides compatibility with the
normal Unix filesystems, and allows naive programs to operate securely (when
opening files in /tmp or /usr/tmp, say) is still possible, and would provide a
more flexible mechanism than the common directory based systems.  It might
work like this:

  The setuid and setgid bits in the mode of a directory would be used to
  specify which logical combination of umask and directory mode access bits
  should be used as the mask when creating files or directories.  The logical
  combinations would be

	00 mask = umask
	01 mask = umask | ~directory mode
	10 mask = umask & ~directory mode
	11 mask = ~directory mode

Users would set their umasks much as they do now, to cover the default case.
Directories like /tmp would be set 00 for security compatibility, while mail
directories would be set 01 for greater protection, project directories would
be set 10 to ensure that files and subdirectories were group writable, and
home directories might be set 11.

For the benefit of really paranoid programs/users, two bits could be added to
the umask to override the directory combination bits, although doing so would
add to the complexity of the system without really increasing security or
flexibility.


@alex

Volume-Number: Volume 5, Number 41