Setting global umask via NSUmask or /etc/launchd.conf and /etc/launchd-user.conf broken?

Question

cpr2011 Author

Level 1

0 points

Setting global umask via NSUmask or /etc/launchd.conf and /etc/launchd-user.conf broken?

The procedure to change the default global umask from 0022 to 0002, so that most files created by one user on a machine will be read-write by other users in the same group, seems to have been broken or to have been changed in OS X Lion from OS X Snow Leopard. What worked as far back as OS X 10.4 and was officially documented was done from Terminal: "defaults write /Library/Preferences/.GlobalPreferences NSUmask 2" (with a sudo, if not logged in as 'root').

Another way documented in various places and which I actually used through OS X 10.6 was also done via Terminal. Two files were created: /etc/launchd.conf (for system-wide global umask) or /etc/launchd-user.conf (for user-specific global umask). The contents of each were simply the single umask command, "umask 002" or ("umask u=rwx,g=rwx,o=rx", I can't remember which variant I used - they're functionally the same, though).

No matter which method I use, the 2nd or the 1st, the global umask no longer changes.

Does anyone know whether this has been deliberately hobbled under OS X Lion, requiring purchase of OS X Lion Server? Is this an OS X Lion bug? Or, am I looking at something wrong?

MacBook Pro, Mac OS X (10.7)

Posted on Jul 23, 2011 5:38 PM

Reply

Answer 1

cpr2011 Author

Level 1

0 points

Jul 24, 2011 8:13 AM in response to cpr2011

/etc/launch.conf and /etc/launch-user.conf work with Lion after all. (...as long as you're putting them on the correct image. 🙂 I had restored Snow Leopard from .dmg to a second disk, and following a link, had actually added the files to the Snow Leopard image. Duh!)

Reply

Answer 2

jsd2

Level 5

6,245 points

Jul 24, 2011 8:53 AM in response to cpr2011

Should others be interested, TinkerTool System, a good utility which has been updated for Lion, offers a user-friendly way to change the user-specific global umask. This screenshot shows the default settings, which can then be easily changed:

I peeked, and TinkerTool System does this by writing to /etc/launchd-user.conf.

Reply

Answer 3

Aug 7, 2011 9:51 AM in response to cpr2011

Hi,

i changed the umask to 002 in tinker tools, in launchd-user.conf and in launchd.conf.

Everything is ok when I create a directory via Terminal (group has rwx). When I create the same directory with the finder the group has only rx 😟

Any ideas how to fix that?

Reply

Answer 4

Aug 7, 2011 11:59 AM in response to Watercool

ok.. umask 077 works.. umask 000 still gives the same rights as 002 do..

Reply

Answer 5

Aug 15, 2011 6:37 AM in response to cpr2011

I think the files should be /etc/launchd.conf and /etc/launchd-user.conf

See the man pages for launchctl and launchd.conf

Reply

Answer 6

jsd2

Level 5

6,245 points

Aug 15, 2011 7:08 AM in response to Clement B. Edgar III

See this support article, which was written for OS X Server, but seems applicable to Mac OS X client versions as well:

Mac OS X Server v10.5, 10.6: Setting a custom umask

The excerpt below describes the use of /etc/launchd-user.conf, and strongly cautions against using /etc/launchd.conf.

---------

Umask for user applications

In Mac OS X v10.5.3 and later, you can create the file /etc/launchd-user.conf with the contents "umask nnn". Do not include the quotation marks and replace nnn with the desired umask value, such as 027 or 002.

This will set the user's umask for all applications they launch, such as Finder, TextEdit, or Final Cut Pro, and control the permissions set on new files created by any of these applications.

.........

Umask for system processes

In Mac OS X v10.4 and later, create the file /etc/launchd.conf with the contents "umask nnn". Do not include the quotation marks and replace nnn with the desired umask value, such as 027 or 002.

This will set the umask for all processes. Changing this value is strongly discouraged because it changes the permissions on files used by the system software. If the permissions are too restrictive, dependent software may not work. If the permissions are too open, they may introduce security issues.

------------------------------------

Reply

Answer 7

MaJac

Level 1

0 points

Oct 20, 2011 11:59 PM in response to jsd2

Hi, I'm trying to change the global umask in Lion but I still have some problems, I alrady try every procedure that I found on the web

1) add a umask specification in files "/etc/launchd".conf" and "etc/launchd-user.conf"

2) add a umask record in "/Library/Preferences/com.apple.finder.plist" and "~/Library/Preferences/com.apple.finder.plist"

Now as Watercool said in his post everything is ok when I create folder from terminal but still doesn't working when I create folders or files from Finder.

Any suggestions?

(I want to put umask = 002, I'm running Mac Os X Lion 10.7.1 on a MacBook 4,1 late 2008)

Reply

Answer 8

SPEEDBDN

Level 1

0 points

Nov 4, 2011 7:32 PM in response to cpr2011

Hi,

I'm having the same problem during testing when I Creating New Folders using Finder, the New Folder are only Read Only to Everyone. Even if the umask 000 setting file is in place etc/launchd-user.conf. the New Folder still has the wrong permissions. But if you use Terminal to create a New Folder à mkdir à Test Folder Permissions are Read & Write and are OK. So it would appear that we may have a Finder problem since Terminal seems to works ok! But I'm sure Apple is aware of the problem.

Reply

Answer 9

Nov 24, 2011 4:05 AM in response to cpr2011

Hm, any news, Apple? I consider this as a critical bug; Files are fine with 644 but directories ...

All of our staff working on SAN volumes is using Path Finder; costs a dime but works much better then finder.

Thank god samba has the force create mode option 🙂

Reply

Answer 10

Jan 24, 2013 11:02 AM in response to Watercool

Thanks Watercool 🙂 setting the umask to 077 helped me with a "snapserver" using AFP.

Reply