# 1. 检查当前umask值
# umask
0022

# 2. 检查所有用户umask配置
# for user in $(awk -F: ‘$3 >= 1000 {print $1}’ /etc/passwd); do
echo -n “$user: ”
su – $user -c “umask” 2>/dev/null || echo “N/A”
done
fgedu: 0002
user1: 0002
user2: 0002

# 3. 检查系统umask配置
# grep -r “umask” /etc/profile /etc/bashrc
/etc/profile: umask 002
/etc/profile: umask 022
/etc/bashrc: umask 002
/etc/bashrc: umask 022

# 4. 检查用户umask配置
# grep “umask” ~/.bashrc ~/.bash_profile
（用户自定义umask配置）

# 5. 测试umask效果
# umask 0027
# touch testfile
# mkdir testdir
# ls -l testfile
-rw-r—–. 1 root root 0 Apr 2 10:00 testfile

# ls -ld testdir
drwxr-x—. 2 root root 6 Apr 2 10:00 testdir

# 6. 检查umask安全性
# cat > /tmp/check_umask_security.sh << 'EOF' #!/bin/bash echo "Checking umask security..." # 检查root用户umask root_umask=$(umask) if [ "$root_umask" == "0022" ]; then echo "Root umask is secure: $root_umask" else echo "Warning: Root umask is $root_umask" fi # 检查普通用户umask for user in $(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
user_umask=$(su – $user -c “umask” 2>/dev/null)
if [ “$user_umask” == “0002” ]; then
echo “$user umask is secure: $user_umask”
else
echo “Warning: $user umask is $user_umask”
fi
done
EOF

# chmod +x /tmp/check_umask_security.sh
# /tmp/check_umask_security.sh

# 1. 系统级umask配置
# 编辑/etc/profile
# vim /etc/profile
if [ $UID -gt 199 ] && [ “`/usr/bin/id -gn`” = “`/usr/bin/id -un`” ]; then
umask 002
else
umask 022
fi

# 2. 用户级umask配置
# 编辑~/.bashrc
# vim ~/.bashrc
umask 0022

# 3. 特定应用umask配置
# 编辑应用启动脚本
# vim /opt/app/bin/start.sh
#!/bin/bash
umask 0027
# 启动应用命令

# 4. 临时umask配置
# 在命令前设置umask
# (umask 0077; touch sensitive_file)

# 5. 不同环境umask配置脚本
# cat > /tmp/set_umask.sh << 'EOF' #!/bin/bash ENV=$1 case $ENV in dev) umask 0002 echo "Development environment: umask 0002" ;; test) umask 0022 echo "Test environment: umask 0022" ;; prod) umask 0027 echo "Production environment: umask 0027" ;; secure) umask 0077 echo "Secure environment: umask 0077" ;; *) echo "Usage: $0 {dev|test|prod|secure}" exit 1 ;; esac EOF # 6. umask配置审计 # cat > /tmp/audit_umask.sh << 'EOF' #!/bin/bash REPORT="/tmp/umask_audit.txt" echo "Umask Audit Report - $(date)" > $REPORT

# 检查系统配置
echo “” >> $REPORT
echo “System Configuration:” >> $REPORT
grep -r “umask” /etc/profile /etc/bashrc /etc/login.defs >> $REPORT

# 检查用户配置
echo “” >> $REPORT
echo “User Configuration:” >> $REPORT
for user in $(awk -F: ‘$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
user_umask=$(su – $user -c “umask” 2>/dev/null)
echo “$user: $user_umask” >> $REPORT
done

echo “Audit completed. Report saved to $REPORT”
EOF

# 1. 查看当前umask值
# umask
0022

# 2. 查看umask值（符号方式）
# umask -S
u=rwx,g=rx,o=rx

# 3. 查看umask值（数字方式）
# umask -p
umask 0022

# 4. 设置umask值
# umask 0027
# umask
0027

# 5. 设置umask值（符号方式）
# umask u=rwx,g=rx,o=
# umask -S
u=rwx,g=rx,o=

# 6. 测试umask效果
# umask 0022
# touch file1.txt
# mkdir dir1
# ls -l file1.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file1.txt
# ls -ld dir1
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir1

# 7. 测试不同umask值
# umask 0002
# touch file2.txt
# mkdir dir2
# ls -l file2.txt
-rw-rw-r–. 1 root root 0 Apr 2 10:00 file2.txt
# ls -ld dir2
drwxrwxr-x. 2 root root 6 Apr 2 10:00 dir2

# 8. 测试严格umask
# umask 0077
# touch file3.txt
# mkdir dir3
# ls -l file3.txt
-rw——-. 1 root root 0 Apr 2 10:00 file3.txt
# ls -ld dir3
drwx——. 2 root root 6 Apr 2 10:00 dir3

# 9. 临时umask（仅对当前命令有效）
# (umask 0077; touch secure_file)
# ls -l secure_file
-rw——-. 1 root root 0 Apr 2 10:00 secure_file

# 10. 恢复默认umask
# umask 0022
# umask
0022

# 11. 验证umask计算
# umask 0022
# touch test_file
# stat -c “%a” test_file
644

# mkdir test_dir
# stat -c “%a” test_dir
755

# 12. 查看umask所有位
# umask
0022

# 13. 设置特殊权限位umask
# umask 4000
# touch suid_file
# ls -l suid_file
-rw——-. 1 root root 0 Apr 2 10:00 suid_file

# 14. 查看完整umask信息
# umask -S
u=rwx,g=rx,o=rx

# 15. 批量测试umask效果
# for mask in 0000 0002 0022 0027 0077; do
echo “umask $mask:”
umask $mask
touch file_$mask
mkdir dir_$mask
ls -ld file_$mask dir_$mask
done
umask 0000:
-rw-rw-rw-. 1 root root 0 Apr 2 10:00 file_0000
drwxrwxrwx. 2 root root 6 Apr 2 10:00 dir_0000
umask 0002:
-rw-rw-r–. 1 root root 0 Apr 2 10:00 file_0002
drwxrwxrwx. 2 root root 6 Apr 2 10:00 dir_0002
umask 0022:
-rw-r–r–. 1 root root 0 Apr 2 10:00 file_0022
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir_0022
umask 0027:
-rw-r—–. 1 root root 0 Apr 2 10:00 file_0027
drwxr-x—. 2 root root 6 Apr 2 10:00 dir_0027
umask 0077:
-rw——-. 1 root root 0 Apr 2 10:00 file_0077
drwx——. 2 root root 6 Apr 2 10:00 dir_0077

# 1. 在脚本中使用umask
# cat > /tmp/create_secure_file.sh << 'EOF' #!/bin/bash # 设置严格umask umask 0077 # 创建敏感文件 touch /tmp/sensitive_data.txt # 创建敏感目录 mkdir -p /tmp/sensitive_dir echo "Secure files created with umask 0077" ls -l /tmp/sensitive_data.txt ls -ld /tmp/sensitive_dir EOF # chmod +x /tmp/create_secure_file.sh # /tmp/create_secure_file.sh -rw-------. 1 root root 0 Apr 2 10:00 /tmp/sensitive_data.txt drwx------. 2 root root 6 Apr 2 10:00 /tmp/sensitive_dir # 2. 在函数中使用umask # cat > /tmp/umask_functions.sh << 'EOF' #!/bin/bash create_public_file() { local file=$1 (umask 0022; touch "$file") echo "Created public file: $file" } create_private_file() { local file=$1 (umask 0077; touch "$file") echo "Created private file: $file" } create_shared_file() { local file=$1 (umask 0002; touch "$file") echo "Created shared file: $file" } # 使用示例 create_public_file /tmp/public.txt create_private_file /tmp/private.txt create_shared_file /tmp/shared.txt ls -l /tmp/*.txt EOF # 3. umask与环境变量 # export UMASK=0027 # umask $UMASK # umask 0027 # 4. umask与用户类型 # cat > /tmp/set_user_umask.sh << 'EOF' #!/bin/bash # 根据用户类型设置umask if [ $UID -eq 0 ]; then # root用户 umask 0022 echo "Root user: umask 0022" elif [ $UID -ge 1000 ]; then # 普通用户 umask 0002 echo "Normal user: umask 0002" else # 系统用户 umask 0077 echo "System user: umask 0077" fi EOF # 5. umask与目录类型 # cat > /tmp/set_dir_umask.sh << 'EOF' #!/bin/bash create_dir_with_umask() { local dir=$1 local umask_val=$2 (umask $umask_val; mkdir -p "$dir") echo "Created directory: $dir with umask $umask_val" } # 创建不同类型的目录 create_dir_with_umask /tmp/public 0022 create_dir_with_umask /tmp/private 0077 create_dir_with_umask /tmp/shared 0002 ls -ld /tmp/public /tmp/private /tmp/shared EOF # 6. umask与文件类型 # cat > /tmp/create_files_with_umask.sh << 'EOF' #!/bin/bash create_config_file() { local file=$1 (umask 0066; touch "$file") chmod 600 "$file" echo "Created config file: $file" } create_log_file() { local file=$1 (umask 0022; touch "$file") chmod 644 "$file" echo "Created log file: $file" } create_script_file() { local file=$1 (umask 0022; touch "$file") chmod 755 "$file" echo "Created script file: $file" } # 使用示例 create_config_file /tmp/app.conf create_log_file /tmp/app.log create_script_file /tmp/app.sh ls -l /tmp/app.* EOF # 7. umask备份和恢复 # 保存当前umask # CURRENT_UMASK=$(umask) # echo $CURRENT_UMASK 0022 # 临时修改umask # umask 0077 # 恢复umask # umask $CURRENT_UMASK # umask 0022 # 8. umask与find命令结合 # find /tmp -type f -exec sh -c 'umask 0027; touch "$1"' _ {} \; # 9. umask与tar命令结合 # (umask 0077; tar -czf /tmp/backup.tar.gz /home/fgedu) # 10. umask与install命令结合 # install -m 600 -o root -g root /dev/null /tmp/secure_file

# 1. 系统级配置（所有用户）
# 编辑/etc/profile
# vim /etc/profile
# 在文件末尾添加
if [ $UID -gt 199 ] && [ “`/usr/bin/id -gn`” = “`/usr/bin/id -un`” ]; then
umask 002
else
umask 022
fi

# 2. 系统级配置（bash shell）
# 编辑/etc/bashrc
# vim /etc/bashrc
# 在文件末尾添加
if [ $UID -gt 199 ] && [ “`/usr/bin/id -gn`” = “`/usr/bin/id -un`” ]; then
umask 002
else
umask 022
fi

# 3. 用户级配置
# 编辑~/.bashrc
# vim ~/.bashrc
# 在文件末尾添加
umask 0022

# 4. 用户级配置（登录shell）
# 编辑~/.bash_profile
# vim ~/.bash_profile
# 在文件末尾添加
umask 0022

# 5. 用户级配置（通用）
# 编辑~/.profile
# vim ~/.profile
# 在文件末尾添加
umask 0022

# 6. 应用级配置
# 编辑应用启动脚本
# vim /opt/app/bin/start.sh
#!/bin/bash
umask 0027
# 启动应用命令

# 7. 服务级配置
# 编辑systemd服务文件
# vim /etc/systemd/system/app.service
[Service]
UMask=0027
ExecStart=/opt/app/bin/start.sh

# 8. 验证配置生效
# source /etc/profile
# umask
0022

# source ~/.bashrc
# umask
0022

# 9. 检查配置优先级
# cat > /tmp/check_umask_priority.sh << 'EOF' #!/bin/bash echo "Checking umask configuration priority..." echo "1. /etc/profile:" grep "umask" /etc/profile echo "" echo "2. /etc/bashrc:" grep "umask" /etc/bashrc echo "" echo "3. ~/.bashrc:" grep "umask" ~/.bashrc 2>/dev/null || echo “No umask in ~/.bashrc”

echo “”
echo “4. ~/.bash_profile:”
grep “umask” ~/.bash_profile 2>/dev/null || echo “No umask in ~/.bash_profile”

echo “”
echo “5. Current umask:”
umask
EOF

# 10. 批量设置用户umask
# cat > /tmp/set_all_users_umask.sh << 'EOF' #!/bin/bash for user in $(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
home_dir=$(awk -F: -v u=$user ‘$1 == u {print $6}’ /etc/passwd)

if [ -d “$home_dir” ]; then
# 添加umask配置到.bashrc
echo “umask 0022” >> “$home_dir/.bashrc”
chown $user:$user “$home_dir/.bashrc”
echo “Set umask for $user”
fi
done
EOF

# 1. Web服务器umask配置
# cat > /tmp/setup_web_umask.sh << 'EOF' #!/bin/bash # Web服务器umask配置 # 文件权限：644（rw-r--r--） # 目录权限：755（rwxr-xr-x） umask 0022 # 创建Web目录 mkdir -p /var/www/html/{uploads,logs,cache} # 设置权限 find /var/www/html -type d -exec chmod 755 {} \; find /var/www/html -type f -exec chmod 644 {} \; echo "Web server umask configured" EOF # 2. 应用服务器umask配置 # cat > /tmp/setup_app_umask.sh << 'EOF' #!/bin/bash # 应用服务器umask配置 # 文件权限：640（rw-r-----） # 目录权限：750（rwxr-x---） umask 0027 # 创建应用目录 mkdir -p /opt/app/{bin,conf,logs,data} # 设置权限 find /opt/app -type d -exec chmod 750 {} \; find /opt/app -type f -exec chmod 640 {} \; echo "Application server umask configured" EOF # 3. 数据库服务器umask配置 # cat > /tmp/setup_db_umask.sh << 'EOF' #!/bin/bash # 数据库服务器umask配置 # 文件权限：600（rw-------） # 目录权限：700（rwx------） umask 0077 # 创建数据库目录 mkdir -p /data/mysql/{data,logs,tmp} # 设置权限 find /data/mysql -type d -exec chmod 700 {} \; find /data/mysql -type f -exec chmod 600 {} \; echo "Database server umask configured" EOF # 4. 开发环境umask配置 # cat > /tmp/setup_dev_umask.sh << 'EOF' #!/bin/bash # 开发环境umask配置 # 文件权限：664（rw-rw-r--） # 目录权限：775（rwxrwxr-x） umask 0002 # 创建开发目录 mkdir -p /project/{src,build,docs} # 设置权限 find /project -type d -exec chmod 775 {} \; find /project -type f -exec chmod 664 {} \; echo "Development environment umask configured" EOF # 5. 共享目录umask配置 # cat > /tmp/setup_shared_umask.sh << 'EOF' #!/bin/bash # 共享目录umask配置 # 文件权限：664（rw-rw-r--） # 目录权限：2775（rwxrwxr-x + SGID） umask 0002 # 创建共享目录 mkdir -p /shared/{projectA,projectB,projectC} # 设置SGID find /shared -type d -exec chmod 2775 {} \; echo "Shared directory umask configured" EOF # 6. 敏感数据umask配置 # cat > /tmp/setup_sensitive_umask.sh << 'EOF' #!/bin/bash # 敏感数据umask配置 # 文件权限：600（rw-------） # 目录权限：700（rwx------） umask 0077 # 创建敏感数据目录 mkdir -p /secure/{keys,certs,backup} # 设置权限 find /secure -type d -exec chmod 700 {} \; find /secure -type f -exec chmod 600 {} \; echo "Sensitive data umask configured" EOF

# 1. 系统级umask加固
# cat > /tmp/harden_system_umask.sh << 'EOF' #!/bin/bash echo "Hardening system umask..." # 备份原配置 cp /etc/profile /etc/profile.bak cp /etc/bashrc /etc/bashrc.bak # 设置系统级umask cat >> /etc/profile << 'PROFILE' # Security hardened umask if [ $UID -eq 0 ]; then umask 0022 else umask 0027 fi PROFILE cat >> /etc/bashrc << 'BASHRC' # Security hardened umask if [ $UID -eq 0 ]; then umask 0022 else umask 0027 fi BASHRC echo "System umask hardened" EOF # 2. 用户级umask加固 # cat > /tmp/harden_user_umask.sh << 'EOF' #!/bin/bash for user in $(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
home_dir=$(awk -F: -v u=$user ‘$1 == u {print $6}’ /etc/passwd)

if [ -d “$home_dir” ]; then
# 备份原配置
[ -f “$home_dir/.bashrc” ] && cp “$home_dir/.bashrc” “$home_dir/.bashrc.bak”

# 添加umask配置
echo “” >> “$home_dir/.bashrc”
echo “# Security hardened umask” >> “$home_dir/.bashrc”
echo “umask 0027” >> “$home_dir/.bashrc”

# 设置所有权
chown $user:$user “$home_dir/.bashrc”

echo “Hardened umask for $user”
fi
done
EOF

# 3. 服务级umask加固
# cat > /tmp/harden_service_umask.sh << 'EOF' #!/bin/bash # 为关键服务设置umask SERVICES="sshd nginx mysql" for service in $SERVICES; do service_file="/etc/systemd/system/${service}.service" if [ -f "$service_file" ]; then # 备份原配置 cp "$service_file" "${service_file}.bak" # 添加UMask配置 if ! grep -q "^UMask=" "$service_file"; then sed -i "/^\[Service\]/a UMask=0027" "$service_file" fi echo "Hardened umask for $service" fi done # 重新加载systemd systemctl daemon-reload EOF # 4. umask安全审计 # cat > /tmp/audit_umask_security.sh << 'EOF' #!/bin/bash REPORT="/tmp/umask_security_audit.txt" echo "Umask Security Audit - $(date)" > $REPORT

# 检查系统配置
echo “” >> $REPORT
echo “System Configuration:” >> $REPORT
grep “umask” /etc/profile /etc/bashrc /etc/login.defs >> $REPORT

# 检查用户配置
echo “” >> $REPORT
echo “User Configuration:” >> $REPORT
for user in $(awk -F: ‘$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
home_dir=$(awk -F: -v u=$user ‘$1 == u {print $6}’ /etc/passwd)

if [ -f “$home_dir/.bashrc” ]; then
user_umask=$(grep “^umask” “$home_dir/.bashrc” | tail -n 1)
echo “$user: $user_umask” >> $REPORT
fi
done

# 检查服务配置
echo “” >> $REPORT
echo “Service Configuration:” >> $REPORT
for service in /etc/systemd/system/*.service; do
if [ -f “$service” ]; then
service_umask=$(grep “^UMask=” “$service” | cut -d= -f2)
if [ -n “$service_umask” ]; then
echo “$service: UMask=$service_umask” >> $REPORT
fi
fi
done

echo “Audit completed. Report saved to $REPORT”
EOF

# 5. 完整umask安全加固
# cat > /tmp/full_umask_hardening.sh << 'EOF' #!/bin/bash echo "Starting full umask hardening..." # 1. 系统级umask加固 ./harden_system_umask.sh # 2. 用户级umask加固 ./harden_user_umask.sh # 3. 服务级umask加固 ./harden_service_umask.sh # 4. umask安全审计 ./audit_umask_security.sh echo "Full umask hardening completed" EOF # chmod +x /tmp/full_umask_hardening.sh # /tmp/full_umask_hardening.sh

# 案例1：文件权限不符合预期
# 症状：创建的文件权限与预期不符

# 排查步骤：
# 1. 检查当前umask值
# umask
0022

# 2. 检查预期权限计算
# 文件权限 = 666 – 022 = 644
# 目录权限 = 777 – 022 = 755

# 3. 测试创建文件
# touch test_file
# ls -l test_file
-rw-r–r–. 1 root root 0 Apr 2 10:00 test_file

# 解决：确认umask值和权限计算正确

# 案例2：umask配置不生效
# 症状：修改umask配置后不生效

# 排查步骤：
# 1. 检查配置文件
# grep “umask” ~/.bashrc ~/.bash_profile /etc/profile

# 2. 检查配置优先级
# 用户配置 > 系统配置 > 默认值

# 3. 重新加载配置
# source ~/.bashrc
# source /etc/profile

# 解决：确保配置文件正确且已重新加载

# 案例3：不同用户umask不同
# 症状：不同用户的umask值不一致

# 排查步骤：
# 1. 检查系统配置
# grep “umask” /etc/profile /etc/bashrc

# 2. 检查用户配置
# grep “umask” ~/.bashrc

# 3. 检查用户UID
# id
uid=0(root) gid=0(root) groups=0(root)

# 解决：统一umask配置或根据UID设置不同umask

# 案例4：umask与特殊权限冲突
# 症状：特殊权限不生效

# 排查步骤：
# 1. 检查umask值
# umask
0022

# 2. 检查特殊权限位
# umask -S
u=rwx,g=rx,o=rx

# 3. 测试特殊权限
# umask 4000
# touch suid_file
# ls -l suid_file
-rw——-. 1 root root 0 Apr 2 10:00 suid_file

# 解决：umask只影响基本权限，特殊权限需要单独设置

# 案例5：umask与目录权限问题
# 症状：目录权限不符合预期

# 排查步骤：
# 1. 检查umask值
# umask
0022

# 2. 计算预期权限
# 目录权限 = 777 – 022 = 755

# 3. 测试创建目录
# mkdir test_dir
# ls -ld test_dir
drwxr-xr-x. 2 root root 6 Apr 2 10:00 test_dir

# 解决：确认umask值和权限计算正确

# 案例6：umask与SGID冲突
# 症状：SGID不生效

# 排查步骤：
# 1. 检查umask值
# umask
0002

# 2. 创建目录并设置SGID
# mkdir shared_dir
# chmod 2775 shared_dir
# ls -ld shared_dir
drwxrwsr-x. 2 root root 6 Apr 2 10:00 shared_dir

# 3. 测试SGID效果
# touch shared_dir/test_file
# ls -l shared_dir/test_file
-rw-rw-r–. 1 root root 0 Apr 2 10:00 shared_dir/test_file

# 解决：umask不影响SGID，SGID需要单独设置

# 案例7：umask与ACL冲突
# 症状：ACL权限不生效

# 排查步骤：
# 1. 检查umask值
# umask
0022

# 2. 设置ACL权限
# setfacl -m u:fgedu:rwx file.txt
# getfacl file.txt

# 3. 测试ACL效果
# su – fgedu
$ cat file.txt
（文件内容）

# 解决：umask不影响ACL，ACL需要单独设置

# 案例8：umask与SELinux冲突
# 症状：SELinux权限不生效

# 排查步骤：
# 1. 检查umask值
# umask
0022

# 2. 检查SELinux上下文
# ls -lZ file.txt
-rw-r–r–. 1 root root unconfined_u:object_r:admin_home_t:s0 0 Apr 2 10:00 file.txt

# 3. 检查SELinux模式
# getenforce
Enforcing

# 解决：umask不影响SELinux，SELinux需要单独配置

# 案例9：umask与文件系统挂载选项冲突
# 症状：文件权限异常

# 排查步骤：
# 1. 检查umask值
# umask
0022

# 2. 检查文件系统挂载选项
# mount | grep “on / ”
/dev/mapper/rhel-root on / type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota)

# 3. 检查文件权限
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 解决：确认文件系统挂载选项正确

# 案例10：umask与用户组权限问题
# 症状：组成员无法访问文件

# 排查步骤：
# 1. 检查umask值
# umask
0022

# 2. 检查文件权限
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 3. 检查用户组
# id fgedu
uid=1000(fgedu) gid=1000(fgedu) groups=1000(fgedu),10(wheel)

# 解决：修改umask为0002或手动设置权限
# umask 0002
# touch file2.txt
# ls -l file2.txt
-rw-rw-r–. 1 root root 0 Apr 2 10:00 file2.txt