dongs

How to change the umask for daemons in Red Hat Enterprise Linux
Solution Verified - Updated February 23 2013 at 9:22 PM - English
Environment

    Red Hat Enterprise Linux 5 and 6 (RHEL)
    initscripts rpm package

Issue

    A security audit says that, the log files created by the daemons are world readable. This needs to be changed as world non-readable or in other words from permission 644 to permission 640.

    How to change the umask for daemons. This is not about system umask which can be changed from /etc/profile or /etc/.bashrc. We are talking about the umask value inherited by the daemons like httpd, postfix etc.

Resolution

Firstly, if the daemon for which we want to set up umask 027, uses the daemon() function from the '/etc/init.d/functions' file, then changing the value in that file will have an effect. But there are daemons too who do not use that function. For them, it is necessary to put a specific line of umask 027 in the initscript of the daemon, like in /etc/rc.d/init.d/<daemoon-name> file.

In both of these situations, the daemon should be restarted.

Also there are certain daemons who set up umask for themselves. So, if it is found that any daemon is not inheriting the umask, it will be necessary to further research on the init script of the daemon.

The daemon() function will start with something like this line. This is tested on RHEL6.
Raw

# A function to start a program.
daemon() {

In the init script of httpd, it is obvious that the daemon function is used to start httpd:
Raw

[root@localhost ~]# grep daemon /etc/rc.d/init.d/httpd
        LANG=$HTTPD_LANG daemon --pidfile=${pidfile} $httpd $OPTIONS

So, changing the value in '/etc/init.d/functions' will work for this.

But for the daemon of postfix, it doesn't source that function.
Raw

[root@localhost ~]# grep daemon /etc/rc.d/init.d/postfix
        # Start daemons.
        # Stop daemons.

It is necessary to put umask 027 in the init script for this daemon as in /etc/rc.d/init.d/<daemon-name>.

Also, updating the initscripts package, will cause the umask value in '/etc/init.d/functions' file to be changed. It is marked as a regular file and not a configuration file.
Root Cause

It is all about how the daemon is started. We need the daemon initscript file to be checked.