Setting default permissions

ahh · 01-20-2007, 09:37 AM

Sorry for the long post, but I believe it will help clarify the problem if I explain my set up.

I have added a user to my system (lets call him netuser) that I use for all internet activity. The rationale behind this is that if this user is compromised he has neither root access nor access to my home directory, so the worst that can happen is that netusers home directory is wiped or altered, a trivial thing to repair.

This is achieved using sudo, where I have it set that I can run any command as netuser without a password. Then, by altering the command issued when I click on, for example, galeon, to sudo -H -u netuser galeon, the process is completely transparent.

So far so good. Now what I have tried to do is have all files created in netusers home directory have the permissions set to 664 so that, as a member of netuser's group, I have full access to all files.

I have found that by adding umask 002 to netuser's .bash_profile, using touch in a terminal opened as netuser will create files with the correct permissions, but if I run galeon, either from the netuser terminal or via sudo it creates file permissions of 644.

I have set defaults:netuser umask=0002 in the sudoers file, but it has no effect.

Does anyone know how I can achieve my aim?

Cheers.

Junior Hacker · 01-20-2007, 02:39 PM

I'm no expert, but it could have something to do with galeon default settings overriding system settings.

Just a suggestion.

ahh · 01-20-2007, 04:27 PM

Thanks.

I did wonder if that was the case. And I was also wondering if it is possible to overcome this, and if so, is it a Galeon or Mozilla/Firefox issue.

Junior Hacker · 01-20-2007, 05:27 PM

Ummm........got me stumped there, because I don't know what Galeon is, just a shot in the dark here, if galeon is used through a GUI, and you have umask set in .bash_profile, it may be possible the umask setting in bash does not apply to a GUI software suite. I base my assumption on the what you say, "if I click on Galeon" but then you mention a sudo command within the same sentence, this has me a little confused mostly because I know nothing about Galeon. As for firefox, I do know if one was to install latest version Firefox 2, you do have to change permissions of the firefox directory wherever you put it for all to execute, then it has to be linked to bin (sub directory) within the directory you installed firefox. Then set ownership:group to root for firefox directory even when installed in /usr/local where it can be used by anyone. If your using default installed firefox, check with #ls -l <directory firefox> to view permissions.
Can you set a umask value for Galeon? I'm sure that avenue, you already walked.
As I mentioned earlier, I'm no expert, and not knowing anything about Galeon has me thinking everything I wrote in this post may just be useless garble.

ahh · 01-22-2007, 07:30 AM

Sorry if what I wrote was confusing.

First, Galeon is another lightweight browser, like Epiphany. It can be built using Mozilla, Sea Monkey or Firefox to supply the rendering engine.

As for the Galeon/sudo bit, what I have done is edit the menu. Where the command to execute used to be galeon, it is now sudo -H -u netuser galeon.

Hope that makes it clearer.

Junior Hacker · 01-22-2007, 08:18 AM

Yes, thanx

Now I re-read your first post.....
Correct me if I'm wrong, but it appears you are not logged in Netuser's account, rather another user account. Theoretically, one would be led to believe that because of the sudo command to start Galeon would apply Netuser's settings, but because the session you are in belongs to another user, I would think the other user's umask value and permissions will ultimately be the settings applied.

unSpawn · 01-24-2007, 07:26 AM

If all fails, how about changing your menu entry "sudo -H -u netuser galeon" to use an intermediary script "sudo -H -u netuser /home/netuser/galeon.sh"?:

Code:

#!/bin/sh --
cd $HOME || exit 1 && { umask 027 && exec galeon; }
exit 0