Linux online course

Set Default Permissions for Newly Created Files and Directories with umask

Learn how Linux umask controls default permissions for new files and directories, including calculation, temporary changes, persistent configuration, and troubleshooting.

umask is a process-level permission mask. It clears permission bits from the mode requested when a program creates a new file or directory. It does not directly assign the final mode.

This distinction matters: the application supplies a creation mode, and the umask removes selected bits. The setting applies only to newly created filesystem objects. It does not change permissions on files or directories that already exist; use chmod for that.

Linux permission fundamentals

Traditional Linux permissions have three classes:

• User or owner: the account that owns the object.
• Group: users who belong to the object's assigned group.
• Other: everyone who is neither the owner nor a member of the assigned group.

Each class can have read, write, and execute permissions:

• Read (r) has octal value 4.
• Write (w) has octal value 2.
• Execute (x) has octal value 1.

Octal permissions use one digit for each class in the order user, group, other. A digit is formed by combining permission bits. For example, read plus write is 4 + 2 = 6, so rw- is represented by 6.

Base creation modes

Applications normally request permissions from these maximum modes:

• Regular files commonly start from 666: rw-rw-rw-.
• Directories commonly start from 777: rwxrwxrwx.

A regular file normally receives no execute permission merely because of the umask. Since its usual base mode is 666, there are no execute bits for the mask to preserve. A directory needs execute permission for traversal and searching, so its base mode includes execute bits.

The base mode is only a useful model, not a guarantee. Applications can request a more restrictive creation mode, so the actual result can be stricter than a calculation using 666 or 777 predicts.

View the active umask

Run umask without arguments in the shell whose setting you want to inspect:

umask

Typical output is an octal value such as 0022 or 0027. The leading zero is commonly shown as part of the octal notation. The final three digits correspond to the user, group, and other mask values.

Some implementations support symbolic output:

umask -S

For example, a symbolic result can show which permissions are masked for each class. Use the numeric form when comparing values or documenting a configuration, and verify the exact output format on the local system.

How umask calculates resulting permissions

Conceptually, the requested creation mode and the mask are compared bit by bit. Every permission bit present in the mask is cleared from the requested mode. This is not ordinary subtraction in every edge case; think of it as removing individual read, write, or execute bits.

For regular files, compare the mask with base mode 666. For directories, compare it with base mode 777.

Common examples

For example, with umask 027, the group write bit and all other-user bits are cleared from a file's 666 base, producing 640. For a directory, the same mask produces 750.

Temporarily change umask in the current shell

Use umask VALUE to change the mask for the current shell process:

umask 002
umask

Child processes started by that shell inherit the setting. This commonly includes commands, scripts, and applications launched from the shell. The change normally ends when the shell session ends unless you place the command in persistent configuration.

Test the result in a disposable directory:

mkdir umask-demo
cd umask-demo
umask 044
touch umask-test-file && mkdir umask-test-dir
ls -ld umask-test-file umask-test-dir
stat -c '%a %A %n' umask-test-file umask-test-dir

With the usual base modes, the file should be 622 (rw--w--w-) and the directory should be 733 (rwx-wx-wx). These permissions are intentionally unusual and are useful for demonstrating bit removal, not for general security policy.

To demonstrate inheritance, start a child shell and inspect its value:

umask 077
sh -c 'umask'

Exit the child shell and then the original shell. A new unrelated shell will use whatever policy applies to that new session.

Configure a persistent per-user umask

The correct startup file depends on the shell and session type. Interactive Bash terminals often read ~/.bashrc. Login shells may read ~/.bash_profile, ~/.bash_login, or ~/.profile, depending on which file exists and on the distribution's startup sequence.

For a Bash interactive-shell default, add a line such as this to the applicable file:

umask 027

For a login-shell default, add the command to the appropriate login startup file when that is the file read by the session:

umask 027

Do not blindly edit every startup file. Identify the active shell and whether the session is login, interactive, graphical, SSH-based, or noninteractive. A later startup file or command can override an earlier setting.

After editing, start a new applicable shell or log out and back in. Then verify:

umask
touch persistent-test-file
mkdir persistent-test-dir
stat -c '%a %A %n' persistent-test-file persistent-test-dir

With umask 027, the usual expected modes are 640 for the file and 750 for the directory.

System-wide umask configuration

A system-wide umask is distribution- and context-dependent. Login programs, PAM, shells, graphical session managers, service managers, and applications may establish the value through different mechanisms.

PAM, or Pluggable Authentication Modules, is a framework commonly used to establish login-session defaults. The pam_umask module can set a session umask from configured policy or user information. Depending on the distribution, administrators may also need to inspect:

• /etc/login.defs and its supported umask-related settings.
• PAM service configuration files that invoke pam_umask.
• Global shell startup files.
• Login-manager and desktop-session configuration.
• Service-manager or application-specific settings for background processes.

Before changing a system-wide default, inspect the distribution's authentication and shell configuration. Do not assume that one file or command controls every process type.

System-wide changes generally affect new login sessions or newly started services, not processes that are already running. A user or application can override a broader system default. Configuration precedence therefore matters: the setting closest to the creating process usually determines the effective mask.

Verify actual permissions

Use touch and mkdir to create test objects after setting the mask. Inspect them with ls -l or stat:

touch umask-test-file && mkdir umask-test-dir
ls -ld umask-test-file umask-test-dir
stat -c '%a %A %n' umask-test-file umask-test-dir

The numeric output from stat makes comparison with the calculated mode convenient, while the symbolic output shows each permission class directly. Always compare expected and actual results rather than assuming the base-mode calculation is the whole policy.

Access Control Lists (ACLs) add permission rules beyond traditional mode bits. A default ACL on the parent directory can affect permissions for new objects. Applications may also request restrictive modes, and services may use a different umask from your interactive shell.

Security and collaboration choices

• 077 is a private default: new regular files are commonly 600, and directories are commonly 700.
• 027 allows the owner full access and the group read or traversal access, while excluding other users.
• 002 is useful for group collaboration when group write access is intended. New files are commonly 664 and directories 775.
• 022 commonly permits everyone to read files and traverse directories, but reserves writing for the owner.

Choose a policy based on who should access the data. World-writable defaults should be used only with a clear reason because they allow unrelated users to modify newly created objects. Directory group collaboration may also require a suitable group ownership policy and, in some environments, the setgid bit or default ACLs.

umask is a default for creation. It is not a replacement for deliberate permission changes. Use chmod when an existing object needs explicit permissions, and use ownership tools when the owner or group must change.

Troubleshooting umask problems

The value in ~/.bashrc does not appear

• The session may be a login shell, graphical session, non-Bash shell, or noninteractive process that does not read ~/.bashrc.
• You may have edited the file but not started a new applicable shell.
• A later startup script or command may reset the value.

Identify the active shell and session type, use the relevant startup or login configuration, start a new session, and run umask. Search applicable startup files for additional umask commands.

A file is not executable

This is normally expected. Regular files commonly use base mode 666, which has no execute bits. Add execute permission deliberately with chmod when the file is intended to be a program or script. Directory execute bits have a different role: they permit traversal and searching.

Actual permissions are more restrictive than expected

The application may have requested a more restrictive creation mode. A default ACL on the parent directory may also be involved. Check the parent directory with getfacl where available, identify the creating process, and inspect the final mode with stat.

A global change affects SSH but not a desktop application or service

Those processes may use different PAM service stacks, session managers, shells, or service-manager settings. Configure the policy in the path used by the affected process, restart or relogin as required, and verify from that actual context.

A user setting defeats the system-wide default

The user's shell startup file may run after the system policy and explicitly set another umask. Review configuration precedence and remove or change the per-user override when appropriate.

Exam-relevant summary

• umask clears permission bits from a requested creation mode; it does not directly assign final permissions.
• It affects newly created objects, not existing files.
• Regular files commonly use base mode 666; directories commonly use 777.
• Read, write, and execute are represented by 4, 2, and 1.
• The three octal mask digits represent user, group, and other.
• umask 002 commonly produces file mode 664 and directory mode 775.
• umask 022 commonly produces 644 and 755.
• umask 027 commonly produces 640 and 750.
• umask 077 commonly produces private modes 600 and 700.
• Child processes inherit the current shell's mask, but a temporary change ends with that shell session.
• Persistent settings depend on shell startup files, PAM, login managers, services, and application configuration.