[gentoo-user] How to set umask for entire Gnome session

[Jorge P. de Morais Neto]

Hi. I want my personal files inaccessible from unprivileged other
accounts. I have already executed the following commands with ~ as
working directory:

find . \( -path ./Public -o -type l \) -prune -o -exec chmod o= {} +
chmod -c o+x .

I now want to change my user's umask from 022 to 027, so new files and
directories will also be secure. I have tried adding to ~/.profile the
line

umask 027

and rebooting but it did not work. I tested by, in Emacs (launched from
Gnome), creating a new file in my Home and it did not respect the 027
umask.

So, how do I change my user's umask for the entire Gnome session?

Regards

[Neil Bothwick]

Post by Jorge P. de Morais Neto
I now want to change my user's umask from 022 to 027, so new files and
directories will also be secure. I have tried adding to ~/.profile the
line
umask 027

That sets the umask for the shell that runs the profile file, not for
your GNOME session.

Post by Jorge P. de Morais Neto
and rebooting but it did not work. I tested by, in Emacs (launched from
Gnome), creating a new file in my Home and it did not respect the 027
umask.
So, how do I change my user's umask for the entire Gnome session?

Do you have a separate filesystem for /home? If so, the simplest option
is to set umask in its mount options in fstab. This will affect all
users, except root, and it won't affect files you write outside of $HOME.

[Jorge P. de Morais Neto]

Hello,

Post by Neil Bothwick
Do you have a separate filesystem for /home? If so, the simplest option
is to set umask in its mount options in fstab. This will affect all
users, except root, and it won't affect files you write outside of $HOME.

That is not documented in the mount manpage as a filesystem-independet
option; it only shows for specific filesystems, none of which I use.
Anyway, I use Btrfs and I have a separate subvolume for /home. I have
tried adding umask=077 (later umask=0077) as fstab option and invoking #

# mount -o remount /home

but in both cases it errored out:

mount: /home: mount point not mounted or bad option.
dmesg(1) may have more information after failed mount system call.

dmesg says:

BTRFS error (device nvme0n1p7: state M): unrecognized mount option 'umask=077'

Regards

[Neil Bothwick]

Post by Jorge P. de Morais Neto

Post by Neil Bothwick
Do you have a separate filesystem for /home? If so, the simplest
option is to set umask in its mount options in fstab. This will
affect all users, except root, and it won't affect files you write
outside of $HOME.

That is not documented in the mount manpage as a filesystem-independet
option; it only shows for specific filesystems, none of which I use.

That's because it is not filesystem-independent.

Post by Jorge P. de Morais Neto
Anyway, I use Btrfs and I have a separate subvolume for /home. I have
tried adding umask=077 (later umask=0077) as fstab option and invoking #
# mount -o remount /home

Because btrfs does not have that option.

Post by Jorge P. de Morais Neto
mount: /home: mount point not mounted or bad option.
dmesg(1) may have more information after failed mount system call.
BTRFS error (device nvme0n1p7: state M): unrecognized mount option 'umask=077'

As it says.

I think ACLs may be a better fit for your needs.