In the past, I have always set umask at ~/.profile. I set a umask of 077 so my documents get a permission of 600 (rw-------). But setting this at ~/.profile no longer works in Ubuntu 17.04.

So as new documents get created in a gnome session on Ubuntu 17.04, where can I configure so that they get created with permission 600?

To set permissions for all directories and files that are created day-forward by any user:

1. sudo nano /etc/pam.d/common-session


2. Find the line with "session optional pam_umask.so"


3. Change this to "session optional pam_umask.so umask=0077"


4. Save the file.


5. Reboot.

New files will be 600.
New directories will be 700.

If you're using GDM, it doesn't read ~/.profile like LightDM does. And the terminal normally opens a non-login shell. The net effect is that ~/.profile is not loaded at all when you open a terminal after logging in using GDM.

Either:

• put your settings in ~/.bashrc, or


• set your terminal to start a login shell, or


• switch to LightDM

# the default umask is set in /etc/profile; for setting the umask

# for ssh logins, install and configure the libpam-umask package.

#umask 022

That's literally what your ~/.profile says. Did you relogin once changed? It should work fine.

Also:

This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login exists.

Actually confirmed the issue on a freshly installed ubuntu 17.04. Even fully updating still causes this issue to arise and even ~/.bash_profileis ignored, there seems to be an issue with the command interpreter not reading those files after login.

You can use ~/.bashrc for now, which still works fine and is read during login.

So after digging a little into it, it seems bash is not run by default with the --login anymore which means it doesn't read the ~/.profile. Starting a new bash with the umask in ~/.profile with bash --login sets the umask correctly starting a bash without it though ignores the ~/.profile. Not sure what was changed but this seems like a bug to me unless it was intentionally changed.

Ubuntu 18.04, should work for 17.04 and others

According to the man pages, there are several places where we can set the umask for the PAM module to find; it even gives an example. I'll set it in /etc/pam.d/login. Note this file does not exist on my version of Ubuntu, in which case we can create it.

$ sudo sh -c "echo 'session optional pam_umask.so umask=0027' >> /etc/default/login"



$ more /etc/default/login

session optional pam_umask.so umask=0027

Evil Bug

Now if we restart and ask for the umask in the terminal we still get 0022 and not the 0027 that was set. See Bug #1685754.

But if we open an application, for example the Text Editor, and save a file we'll notice the new umask is set correctly. Open it from the menu, not from the terminal as it seems to pick up the (bad) umask from the terminal.

$ touch terminal-file

$ ls -l

-rw-r-----  1 daniel daniel    0 jan 28 21:21 gedit-file

-rw-r--r--  1 daniel daniel    0 jan 28 21:22 terminal-file

References

• Ubuntu Manpage for pam_umask
  


• Bug #1685754, since 17.04