I have a directory that has the following permissions set:drwxr-s---. user group folderOn the desktop, I access this folder and right click to create a new file call foo.txt. Then using the terminal, I created another file using the command $ touch bar.txt.When I check the permissions for these files, I have:-rw-r--r--. user group foo.txt-rw-rw-r--. user group bar.txtI was expecting -rw-r-----. user group. How did the extra write permission for group and read permission for others come about?
How are file permissions applied to newly created files?
permissions
setguidThere are 2 forces here at work. The first is the setgid bit that's enabled on the folder, folder.drwxr-s---. user group folderThat's the s in the pack of characters at the beginning of this line. They're grouped thusly:d - directoryrwx - read/write/execute bits for userr-s - read/execute/setuid bits for group--- - nothing for other usersThe r-s means that any files or directories created inside this folder will have the group automatically set to the group group.That's what caused the files foo.txt and bar.txt to be created like so:-rw-r--r--. user group foo.txt-rw-rw-r--. user group bar.txtpermissions & umaskThe permissions you're seeing are another matter. These are governed by the settings for your umask. You can see what your umask is set to with the command umask:$ umask0002NOTE: these bits are also called mode bits.It's a mask so it will disable any of the bits related to permissions which are enabled. In this example the only bit I want off is the write permissions for other.0 - skipping for this conversation0 - value of user bits0 - value of group bits2 - value of other bitsThe representation of the bits in this command are in decimal form. So a 2 equates to 010 in binary form, which is the write bit. A 4 (100) would mean you want read disabled. A 7 (111) means you want read/write/execute all disabled. Building it up from here:$ umask 007Would disable the read/write/execute bits for other users.So then what about your files?Well the umask governs the permissions that will get set when a new file is created. So if we had the following umask set:$ umask 007And started touching new files, we'd see them created like so:$ touch newfile1.txt newfile2.txt$ ls -l |grep newfile-rw-rw----   1 saml saml        0 Nov  3 22:34 newfile1.txt-rw-rw----   1 saml saml        0 Nov  3 22:34 newfile2.txtIf we changed it to something else, say this:$ umask 037$ ls -l |grep newfile-rw-rw----   1 saml saml        0 Nov  3 22:36 newfile1.txt-rw-rw----   1 saml saml        0 Nov  3 22:36 newfile2.txt-rw-r-----   1 saml saml        0 Nov  3 22:35 newfile3.txt-rw-r-----   1 saml saml        0 Nov  3 22:35 newfile4.txtIt won't have any impact on files that we've already created though. See here:$ umask0037$ touch newfile1.txt newfile2.txt$ ls -l | grep newfile-rw-rw----   1 saml saml        0 Nov  3 22:37 newfile1.txt-rw-rw----   1 saml saml        0 Nov  3 22:37 newfile2.txt-rw-r-----   1 saml saml        0 Nov  3 22:35 newfile3.txt-rw-r-----   1 saml saml        0 Nov  3 22:35 newfile4.txtSo then what's going on with the file browser?The umask is what I'd called a soft setting. It is by no means absolute and can be by-passed fairly easily in Unix in a number of ways. Many of the tools take switches which allow you to specify the permissions as part of their operation.Take mkdir for example:$ umask0037$ mkdir -m 777 somedir1$$ ls -ld somedir1drwxrwxrwx 2 saml saml 4096 Nov  3 22:44 somedir1With the -m switch we can override umask. The touch command doesn't have this facility so you have to get creative. See this U&L Q&A titled: Can files be created with permissions set on the command line? for just such methods.Other ways? Just override umask. The file browser is most likely either doing this or just completely ignoring the umask and laying down the file using whatever permissions it's configured to do as.