Umask

A process's file-creation mask, or umask, prevents selected permission bits from being set when that process creates a filesystem object. It is a mask, not a complete default mode: the application first requests a mode, and the kernel removes bits prohibited by the umask.

Conceptually:

resulting mode = requested mode AND NOT umask

Access control lists and application behavior can add further details, so inspect the result when exact permissions matter.

Viewing and Setting the Umask

Run umask without an operand to display the current shell's mask, often in octal form:

$ umask
0022

Set it for the current shell and the processes subsequently started by that shell:

$ umask 027

Each octal position corresponds to owner, group, and other. A mask bit removes the corresponding requested permission: 2 masks write, 4 masks read, and 1 masks execute.

Calculating New File and Directory Modes

Many ordinary programs request 0666 for new regular files, because creating executable files by default would be unsafe. They commonly request 0777 for new directories, where execute permission is required for traversal.

With umask 0022:

regular file: 0666 masked by 0022 -> 0644 (rw-r--r--)
directory:    0777 masked by 0022 -> 0755 (rwxr-xr-x)

The umask only removes requested bits. It cannot add execute permission when an application did not request it. An application can also request a more restrictive starting mode, producing a more restrictive result.

Scope and Persistence

Changing the umask in one shell does not alter its parent process or unrelated sessions. The value applies to future creations by that shell and its descendants; existing files retain their modes.

To make a preferred value persistent, configure it in the appropriate login, shell, PAM, service-manager, or application configuration for your environment. The correct location varies, and services may set their own umask. Avoid assuming that editing one interactive shell file governs every process on the system.

For hands-on practice, create files and directories under different masks in an isolated environment, then compare their modes with ls -ld. The Linux User Group and File Permissions lab offers a suitable permissions workspace.

Summary

You can now predict how a umask limits newly requested permissions.

1. View or set the current shell's mask with umask.
2. Remove masked bits from the mode requested by an application.
3. Distinguish common file requests of 0666 from directory requests of 0777.
4. Treat umask scope and persistence as process- and environment-specific.