[CentOS] Apache umask

Sun Jul 19 21:26:02 UTC 2020
Chris Schanzle <chris.schanzle at nist.gov>

On 7/13/20 6:40 PM, Emmett Culley via CentOS wrote:
> I need to set the umask for apache to 002.  I've tried every idea I've found on the internet, but nothing make a difference.  Most suggest that I put "umask 002" in /etc/sysconfig/httpd, but that doesn't seem to make a difference.  Other's suggest adding something to the httpd.service script for systemd.  And that doesn't make any difference.

I had a couple sideline emails with Emmett about suexec possibly being the culprit.  TL;DR: that's not it.

The apache suexec utility can enforce a umask (typically 022) on CGI and SSI (server-side includes).  Taking a look at the source in support/suexec.c, if compiled with AP_SUEXEC_UMASK set to some value, it will set the umask; else there is no umask change.  AP_SUEXEC_UMASK is set via ./configure with --with-suexec-umask.

In CentOS 8 httpd-2.4.37-21.module_el8.2.0+382+15b0afa8.src.rpm the httpd.spec for ./configure with suexec-related configuration flags are notably absent of --with-suexec-umask.  I also did a prep of the sources and no patches modify the suexec sources in this way. 

I similarly checked CentOS 7.8 httpd-2.4.6-93.el7.centos.src.rpm with the same result.

Just thought I'd share my dead-end attempt to help since suexec hasn't been mentioned.  :-)