umask 077 vs chmod o-rwx for securing directories

Direct Answer

Use system-wide umask 077 as a baseline for all interactive sessions and services when you want every new file and directory to default to 600/700 (owner-only). Use per-directory chmod o-rwx (or default ACLs) for specific paths that must stay private regardless of the creating process's umask—such as shared application data directories, /home/user/private, or any location written by multiple users or automated jobs.

For temporary elevation inside a script, run the looser-umask block in a subshell so the parent shell's umask is never altered: ( umask 022; commands... ). If you must change umask in the current shell, save it first and restore it in a trap on EXIT.

When to Choose Each Approach

System-wide umask 077

• Sets the default creation mask for a login session and all child processes (/etc/profile, /etc/login.defs UMASK, or PAM pam_umask.so).
• New files become rw------- (600); new directories become rwx------ (700).
• Applies automatically—no per-directory maintenance.
• Risk: breaks apps that expect group-readable files (shared caches, web content, database sockets). Test in staging first.

Per-directory chmod o-rwx / Default ACLs

• chmod o-rwx /path strips existing "others" bits only; it does not affect future creations.
• For persistent "no others" on new objects, set a default ACL: setfacl -d -m o::0 /path (requires filesystem ACL support: ext4/xfs/btrfs with acl mount option).
• Targeted, survives umask changes, works across multiple users/processes writing to the same tree.
• Caveat: some tools (tar, rsync) ignore ACLs unless flags (--acls, -A) are used.

Safe Temporary Elevation in Scripts

1. Preferred—subshell isolation:

   ( umask 022
     # commands that need group/other readability
     create_shared_cache
   )

   The parent shell's umask is untouched.
2. If you must stay in the same shell:

   old_umask=$(umask)
   umask 022
   trap 'umask "$old_umask"' EXIT
   # commands...
   # umask restored automatically on exit, error, or signal

3. Never export the changed umask or source a script that alters it without restoration (. script.sh shares the process).

Verification Steps

• umask -S — shows current mask symbolically (expect u=rwx,g=,o= for 077).
• touch testfile && mkdir testdir && ls -l — confirms 600/700 on new objects.
• getfacl -d /target/dir — verifies default ACLs are present.
• stat -c '%a %n' /path/* — audits actual permissions on existing entries.

One Diagnostic Detail Needed

What is the current system-wide umask (run umask in a fresh login shell) and does the target filesystem support ACLs (mount | grep acl)? The answer determines whether a global umask 077 is viable or if you must rely on default ACLs for shared directories.