Linux What is umask (user mask) for file and directory creation permissions and how to calculate umask and change the defaults

umask are the default permissions that are applied when a file or directory are created.  To see this in action simply just "touch filename" or "mkdir somedir" and you'll see what default permissions are applied.

The first thing I always tell people you should know is to NEVER change the defaults unless you are making them more restrictive.  But they work well and if you change the defaults you could end up creating a file without permission to read or write it which could break some scripts.  If you made things less restrictive it is a security issue in my opinion.

It is said umask is the reverse or opposite of standard permissions but before we explain how to calculate them let's see what happens with the default umask settings.

As we can see the defaults as with most Unix systems are 022:

[root@evohostingtor2017 umasktest]# umask

Knowing this let's check the default creation permissions of a file and directory below:

[root@evohostingtor2017 umasktest]# mkdir umaskdir
[root@evohostingtor2017 umasktest]# touch umaskfile


[root@evohostingtor2017 umasktest]# ls -alh

drwxr-xr-x 3 root root 4.0K Oct 31 18:55 .
drwxrwxrwt 5 root root 4.0K Oct 31 18:55 ..
drwxr-xr-x 2 root root 4.0K Oct 31 18:54 umaskdir
-rw-r--r-- 1 root root    0 Oct 31 18:55 umaskfile

The results are the following:

Directory permissions = 755

File permissions = 644

Why Doesn't Umask 0 or other modes with execute result in an executable file permission?

Let's go back to the answer above and now explain how umask is calculated and files and directories.

umask is about restricting permissions, in essence this means there are maximum permissions you can subtract from (not add to).   What umask is doing is subtracting the values from the maximum possible permissions (more on that below).

umask like normal permissions still uses octal values:

0=read, write, execute
1=read, write
2=read, execute
4=write, execute
7=no permissions

How do we calculate umask values?

The values are calculated different for files vs directories.

Directories: Maximum possible permissions are 777 (read, write, execute)

Files: Maximum possible permissions are 666 (read, write)

*Note execute is NOT possible to set during file creation.

How We Calculate umask

Let's take our default of 022.

Directories: ( 777 - 022 ) = 755

Files: (777 - 022) = 644 (we always drop any 1's/execute bits because files cannot have execute permissions upon creation due to POSIX restrictions).

More calculations (033):

Directories: (777-033) = 744

Files: (777-033) = 644 (oops remember to drop the 1 from the 7)


Directories: (777-026) = 751

Files: (777-026) = 640

Basically all we do is take the last 3 numbers and subtract them from the maximum possible permissions (aside from files where we drop a 1 for execute since it is not possible ).

 Useful Quiz Here:

What about the leading 0 (something that I don't like to talk about and recommend almost never be used)

It can have a maximum value of 7 like the rest of umask.

SETUID=4 (allows the file to be executed as the owner even when another user or group accesses it)

SETGID=2 (allows the file to be executed as the group even when another user or group accesses it)

uid or gid being set represents itself as a small "s" and if you see it with a capital "S" it means it takes no effect (this means the user or group does not have execute permissions).

Sticky Bit=1  (makes it so only the owner can delete or move it).

sticky bit is represented by a small "t" if it takes effect where other has execute permissions (otherwise it takes no effect and will show as a capital "T").



linux, umask, user, directory, creation, permissions, calculate, defaultsthe, defaults, restrictive, creating, scripts, default, settings, unix, evohostingtor, umasktest, mkdir, umaskdir, umaskfile, ls, alh, drwxr, xr, oct, drwxrwxrwt, rw, doesn, modes, execute, executable, calculated, directories, restricting, essence, maximum, subtract, subtracting, octal, vs,

Latest Articles

  • Cisco Switches How To Get Of Port Line Status Console Messages
  • Cisco DHCP Snooping Relay Setup Information
  • Cisco Switch Setup Guide Command List
  • Cisco 2960 Switch Reset To Factory Defaults
  • How To Boot Cisco CUCM UCSInstall 8.6, 10, 11 and 12 on KVM/Proxmox
  • VBOX VirtualBox How To Import Raw .img Disk File
  • Windows Server 2012, 2016, 2019 How To Install and Missing Disabled Telnet Client
  • proxmox vm networking breaks when you restart your network on the hostnode
  • Linux ln symlink how to update existing symbolic link
  • Ubuntu 18.04 / Linux Mint 19.1 Cannot Type or Login - solution
  • LUKS Hard Drive Encryption on Linux Mint Ubuntu Debian etc how to mount encrypted hard drive
  • How to use nmap locate other machines/computers/servers on your network using nmap
  • Linux Mint 18.2 Create Config File To Start Application Upon Login
  • Dell Wyse Thin Client BIOS Access Key
  • sudoers file in /etc warning about comments/includes!
  • Centos 7 Reallocate logical volume space to another
  • lvm how to reduce volume size
  • letsencrypt certbot error "Unable to find a virtual host listening on port 80 which is currently needed for Certbot to prove to the CA that you control your domain. Please add a virtual host for port 80."
  • SSH error cannot Forward or Listen "bind: Cannot assign requested address"
  • X11 SSH Linux Forwarding Error