A process's file-creation mask, or umask, prevents selected permission bits from being set when that process creates a filesystem object. It is a mask, not a complete default mode: the application first requests a mode, and the kernel removes bits prohibited by the umask.
Permissions · Lesson 4
Umask
Learn how a process umask limits the permission bits requested for newly created files and directories.
Conceptually:
resulting mode = requested mode AND NOT umask
Access control lists and application behavior can add further details, so inspect the result when exact permissions matter.
Viewing and Setting the Umask
Run umask without an operand to display the current shell's mask, often in octal form:
$ umask
0022
Set it for the current shell and the processes subsequently started by that shell:
$ umask 027
Each octal position corresponds to owner, group, and other. A mask bit removes the corresponding requested permission: 2 masks write, 4 masks read, and 1 masks execute.
What does umask 027 change in the current shell?
Calculating New File and Directory Modes
Many ordinary programs request 0666 for new regular files, because creating executable files by default would be unsafe. They commonly request 0777 for new directories, where execute permission is required for traversal.
With umask 0022:
regular file: 0666 masked by 0022 -> 0644 (rw-r--r--)
directory: 0777 masked by 0022 -> 0755 (rwxr-xr-x)
The umask only removes requested bits. It cannot add execute permission when an application did not request it. An application can also request a more restrictive starting mode, producing a more restrictive result.
If a program requests mode 0666 for a regular file and the umask is 0022, which mode results?
If a program requests 0777 for a directory and the umask is 0027, which mode results?
Scope and Persistence
Changing the umask in one shell does not alter its parent process or unrelated sessions. The value applies to future creations by that shell and its descendants; existing files retain their modes.
To make a preferred value persistent, configure it in the appropriate login, shell, PAM, service-manager, or application configuration for your environment. The correct location varies, and services may set their own umask. Avoid assuming that editing one interactive shell file governs every process on the system.
What happens to an existing file when you set a new umask?
For hands-on practice, create files and directories under different masks in an isolated environment, then compare their modes with ls -ld. The Linux User Group and File Permissions lab offers a suitable permissions workspace.
Lesson complete
You finished Umask
You can now predict how a umask limits newly requested permissions.
View or set the current shell's mask with
umask.Remove masked bits from the mode requested by an application.
Distinguish common file requests of
0666from directory requests of0777.Treat umask scope and persistence as process- and environment-specific.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account