Umaskのソースを表示

[[Category:セキュリティ]]
[[Category:ファイルシステム]]
[[en:Umask]]
[[es:Umask]]
{{Related articles start}}
{{Related|ファイルのパーミッションと属性}}
{{Related articles end}}

''umask'' ユーティリティはファイル作成モードマスクを制御するのに使われます。モードマスクは新しく作成されたファイルのファイルパーミッションの初期値を決定します。このユーティリティの挙動は [[wikipedia:ja:POSIX|POSIX]] によって仕様化されており、[http://pubs.opengroup.org/onlinepubs/9699919799/utilities/umask.html POSIX のプログラマーマニュアル] に解説があります。''umask'' はシェルの実行環境に影響を与えるため、基本的にシェルのビルトインコマンドとして実装されます。

== モードマスクの意味 ==

The mode mask contains the permission bits that should '''not''' be set on a newly created file, hence it is the [[wikipedia:Logical complement|logical complement]] of the permission bits set on a newly created file. If some bit in the mask is set to {{ic|1}}, the corresponding permission for the newly created file will be disabled. Hence the mask acts as a filter to strip away permission bits and helps with setting default access to files.

The resulting value for permission bits to be set on a newly created file is calculated using bitwise [[wikipedia:Material nonimplication|material nonimplication]] (also known as abjunction), which can be expressed in logical notation:

 R: (D & (~M))

That is, the resulting permissions {{ic|R}} are the result of [[wikipedia:Logical conjunction|bitwise conjunction]] of default permissions {{ic|D}} and the [[wikipedia:Bitwise negation|bitwise negation]] of file-creation mode mask {{ic|M}}.

{{Note|
* Linux does not allow a file to be created with execution permissions, in fact the default creation permissions are 777 for directories, but only 666 for files.
* On Linux, only the file permission bits of the mask are used, i.e. the 022 mask is equivalent to 0022.[http://man7.org/linux/man-pages/man2/umask.2.html]
}}

For example, let us assume that the file-creation mode mask is 027. Here the bitwise representation of each digit represents:

* 0 stands for the ''user'' permission bits not set on a newly created file
* 2 stands for the ''group'' permission bits not set on a newly created file
* 7 stands for the ''other'' permission bits not set on a newly created file

With the information provided by the table below this means that for a newly created file, for example owned by {{ic|User1}} user and {{ic|Group1}} group, {{ic|User1}} has all the possible permissions (octal value 7) for the newly created file, other users of the {{ic|Group1}} group do not have write permissions (octal value 5), and any other user does not have any permissions (octal value 0) to the newly created file. So with the 027 mask taken for this example, files will be created with 750 permissions.

{| class="wikitable"
|+
! Octal !! Binary !! Meaning
|-
| 0 || 000 || no permissions
|-
| 1 || 001 || execute only
|-
| 2 || 010 || write only
|-
| 3 || 011 || write and execute
|-
| 4 || 100 || read only
|-
| 5 || 101 || read and execute
|-
| 6 || 110 || read and write
|-
| 7 || 111 || read, write and execute
|}

== 現在のマスクの値を表示 ==

現在のマスクを表示するには、何も引数を付けずに ''umask'' を実行します。デフォルトの出力スタイルは実装によりますが、基本的に8進数で表示されます:

{{hc|$ umask|0027}}

When the {{ic|-S}} option, standardized by POSIX, is used, the mask will be displayed using symbolic notation. However, the '''symbolic notation value will always be the logical complement of the octal value''', i.e. the permission bits to be set on the newly created file:

{{hc|$ umask -S|2=
u=rwx,g=rx,o=
}}

== マスクの値を設定 ==

{{Note|Umask values can be set on a case-by-case basis. For example, desktop users may find the restricted permissions on their home folder ({{ic|chmod 700}}, as applied by {{ic|useradd -m}}) sufficient, as they make all files within unaccessible to other users. Should this not be practical (for example when using [[Apache]]), and public files are stored amongst private ones, then consider restricting the umask instead.}}

umask の値は ''umask'' コマンドで設定することができます。モードマスクを指定するのに使う文字列は [[chmod]] でモードを指定する時と同じ構文ルールに従っています (詳しくは [http://pubs.opengroup.org/onlinepubs/9699919799/utilities/chmod.html#tag_20_17_13 POSIX Programmer's Manual] を参照)。

(Arch を含む [https://projects.archlinux.org/svntogit/packages.git/tree/trunk/profile?h=packages/filesystem]) ほとんど Linux ディストリビューションはデフォルト値を {{ic|022}} に設定しています。もしくは {{ic|/etc/profile}} や {{ic|/etc/bashrc}} などのデフォルト[[シェル]]設定ファイルで {{ic|002}} に設定されています。

If you need to set a different value, you can either directly edit such file, thus affecting all users, or call ''umask'' from your shell's user configuration file, e.g. {{ic|~/.bashrc}} to only change your umask, however these changes will only take effect after the next login. To change your umask during your current session only, simply run ''umask'' and type your desired value. For example, running {{ic|umask 077}} will give you read and write permissions for new files, and read, write and execute permissions for new folders.

== 参照 ==

* POSIX プログラマーマニュアル:
** [http://pubs.opengroup.org/onlinepubs/9699919799/utilities/umask.html umask] (also available as {{ic|umask(1P)}})
** [http://pubs.opengroup.org/onlinepubs/9699919799/utilities/chmod.html#tag_20_17_13 chmod (extended description)] (also available as {{ic|chmod(1P)}})
* [[wikipedia:umask]]
* [https://blogs.gentoo.org/mgorny/2011/10/18/027-umask-a-compromise-between-security-and-simplicity/ 027 umask: a compromise]