VMware ESXi and vSphere Cluster Management

Set Default Permissions for New Files and Directories with umask in Linux

Learn how Linux umask controls default permissions for new files and directories, including calculations, temporary and persistent settings, PAM configuration, and safe validation.

umask is a Linux permission mask used when a program creates a new file or directory. It removes selected permission bits from the mode requested by the program. This lets you control the default access granted to newly created filesystem objects.

umask applies at creation time only. Changing a process's umask does not modify files or directories that already exist. Also, programs can request creation modes that are more restrictive than the usual defaults, so the final permissions can vary by application.

This guide covers the common Linux file-permission workflow: understand permission bits, calculate the result, change umask, persist it, and verify the result safely.

Linux permission fundamentals

Linux permissions are divided into three classes:

• Owner or user: the account that owns the file or directory.
• Group: the group associated with the filesystem object.
• Others: users who are neither the owner nor using the file's associated group permissions.

Each class can have three permissions:

• Read (r): read a file's contents. On a directory, read permits listing names when the user also has appropriate access.
• Write (w): modify a file. On a directory, write permits creating, removing, or renaming entries when combined with execute permission.
• Execute (x): run a program or script. On a directory, execute means traverse or search it, allowing access to entries when the path is otherwise permitted.

These values form octal permissions. Add the values within each class: read is 4, write is 2, and execute is 1. Three octal digits then represent owner, group, and others, in that order.

rwx  rwx  rwx
421  421  421
owner group others

For example, 755 means owner permissions 7 (rwx), group permissions 5 (r-x), and others permissions 5 (r-x). The symbolic form is rwxr-xr-x.

What umask does

A program supplies a requested creation mode to the operating system. The kernel then applies the process's umask by clearing permission bits selected by the mask. The permissions left after this operation become the initial permissions of the new object.

The commonly taught maximum requested modes are:

• Regular files: 666, or rw-rw-rw-. Regular files normally do not receive execute permission merely because directories use a maximum mode of 777.
• Directories: 777, or rwxrwxrwx. Directory execute permission is needed for traversal and searching.

These are starting points for calculation, not guarantees. An application may request a more restrictive mode. For example, a program can create a file with no group permissions even when the umask would have allowed them.

How to calculate final permissions

For beginner-level calculations, start with 666 for a regular file and 777 for a directory, then remove every permission bit present in the umask.

The more accurate model is bit masking, not unrestricted decimal subtraction. A umask can clear read, write, or execute bits in each permission class; it does not add permissions and should not be treated as an ordinary number subtracted from the mode. The familiar examples happen to produce useful arithmetic-looking results because the octal digits correspond to permission-bit groups.

Representative masks

• 002 removes write permission from others.
• 022 removes write permission from group and others.
• 027 removes write permission from group, and read, write, and execute permissions from others.
• 044 removes read permission from group and others. This is mathematically valid but usually impractical and unsafe because it can allow writing without reading.
• 077 removes all group and others permissions.

Worked examples

With umask 002:

• Regular file: 666 becomes 664, or rw-rw-r--.
• Directory: 777 becomes 775, or rwxrwxr-x.

With umask 022:

• Regular file: 666 becomes 644, or rw-r--r--.
• Directory: 777 becomes 755, or rwxr-xr-x.

With umask 027:

• Regular file: 666 becomes 640, or rw-r-----.
• Directory: 777 becomes 750, or rwxr-x---.

With umask 044:

• Regular file: 666 becomes 622, or rw--w--w-.
• Directory: 777 becomes 733, or rwx-wx-wx.

With umask 077:

• Regular file: 666 becomes 600, or rw-------.
• Directory: 777 becomes 700, or rwx------.

View the current umask

Run umask without an argument:

umask

A typical result is 0002 or 0022. The leading zero indicates octal notation or is a display convention. Interpret the final three permission digits as the owner, group, and others mask values.

Some shells support symbolic output:

umask -S

This may display a result such as u=rwx,g=rwx,o=rx, showing the permissions that are allowed by the mask for each class. Check your shell's documentation if this option is unavailable.

Temporarily change umask in the current shell

Use umask VALUE to set a numeric mask:

umask 027
umask

The change affects the current shell and processes launched from it. It is inherited by child processes, but it disappears when that shell exits unless you save it in configuration.

Use a temporary directory or clearly named objects for testing:

umask 027
touch umask-test-file && mkdir umask-test-directory
ls -ld umask-test-file umask-test-directory
stat -c '%n %a %A' umask-test-file umask-test-directory
rm -f umask-test-file && rmdir umask-test-directory

Typical results are mode 640 for the file and 750 for the directory. The exact result can differ if the creating program requests a more restrictive mode.

Persist a user-specific umask

To make a setting repeat across shells, put the command in the startup file read by the intended shell type. For interactive Bash shells, a common choice is ~/.bashrc:

umask 027

Edit the file with your preferred text editor, add the line, and start a new shell. You can also load the file immediately in the current Bash session:

. ~/.bashrc
umask

Login shells and interactive non-login shells do not necessarily read the same files. Bash commonly uses login-profile files such as ~/.bash_profile, ~/.bash_login, or ~/.profile for login initialization, while ~/.bashrc is commonly used for interactive non-login shells. The exact chain depends on the shell and distribution. A graphical application, service, or terminal emulator may also start through a path that does not read ~/.bashrc.

A new shell or new login is needed for a startup-file change to apply automatically. A user-level shell command can override a broader default for that shell session.

Configure a system-wide default

Login-session defaults are commonly configured through PAM, the Pluggable Authentication Modules framework. A system may use the pam_umask module, distribution-specific PAM configuration, or login-default configuration. The exact file, utility, and syntax vary by distribution.

On systems where it is installed and supported, a historical pam-config-style command may look like this:

pam-config -a --umask --umask-umask=027

Use that command only when pam-config exists and documents those options for the system. Verify the resulting PAM configuration using the distribution's documentation. Do not copy a configuration layout from another distribution without checking its supported mechanism.

Log out and log back in after changing a login-session setting. Existing sessions normally retain the umask they inherited when they started.

When troubleshooting precedence, inspect the complete startup path. PAM may establish an initial session value, a shell initialization file may replace it, and an application may request a more restrictive creation mode. Services can have their own service-manager or application configuration and may not inherit an interactive user's shell settings.

Validate results safely

A reliable test checks both symbolic and numeric permissions:

1. Set or confirm the intended umask.
2. Create one temporary regular file and one temporary directory.
3. Inspect them with ls -ld and stat.
4. Remove both test objects.

umask 027
touch umask-test-file && mkdir umask-test-directory
ls -ld umask-test-file umask-test-directory
stat -c '%n %a %A' umask-test-file umask-test-directory
rm -f umask-test-file && rmdir umask-test-directory

ls -ld shows symbolic permissions and ownership. The stat command above prints the object name, numeric mode, and symbolic mode. The -d option is important for inspecting the directory itself rather than its contents.

Security and collaboration guidance

Choose a mask based on who should access newly created content:

• Use 077 for private files and directories, such as credentials, personal data, and sensitive project output.
• Use 027 when the owner and an associated group need access but other local users should be blocked.
• Use 002 when group members need write access to new content, provided the directory and group ownership are configured correctly.

Permissive defaults can expose sensitive information to other local users. Remember that umask controls default creation permissions; it does not replace ownership management, ACLs, or deliberate use of chmod.

For effective group collaboration, the shared directory usually needs the intended group ownership and suitable group permissions. A setgid directory has the setgid bit set and causes newly created entries to inherit the directory's group. Without this, a file may receive a collaborative mode but still have an unexpected group. ACLs or other policy may also change the observed result.

Scope and persistence summary

Troubleshooting

The output has four digits

The first zero is an octal notation prefix or display convention. Treat the final three digits as the owner, group, and others mask values.

The setting resets in a new terminal

A command entered in one terminal changes only that shell process and its children. Add the command to the appropriate startup file or configure a login-session default.

A setting in ~/.bashrc has no effect

The process may not read ~/.bashrc. Identify whether it starts from a login shell, graphical display manager, service manager, desktop session, or another shell, then use the relevant configuration mechanism.

New regular files are not executable

Regular files generally start from mode 666, which has no execute bits. umask removes permissions; it does not add execute permission. Use chmod to make a specific script or program executable when appropriate.

The result differs from simple subtraction

umask clears permission bits, and the application may request a mode more restrictive than 666 or 777. Reason in terms of individual bits and inspect the creating program's behavior.

pam-config is unavailable

The distribution may not ship that utility or may use a different configuration layout. Consult the distribution's PAM, login-default, or account-management documentation for its supported system-wide method.

Group members cannot edit new files with umask 002

Inspect ownership and ACLs. The file may have an unexpected group, the directory may not belong to the collaboration group, or an ACL may restrict access. Configure the directory's group correctly and consider the setgid directory bit so new entries inherit that group.