LFCS 38 🐧 Default Permissions — umask - KandZ

⏱️ Estimated read: 14 min | |

Every file and directory created on a Linux system starts with a default set of permissions. The shell sets them, the applications inherit them, and the values come from a mask called the umask. The umask is not a permission itself; it is a mask that subtracts bits from the maximum allowed permissions. A file created with a umask of 022 ends up with 644, and a directory ends up with 755. The umask is one of the few settings that applies to every file a user creates without the user doing anything, which is why it matters for security and for collaboration.

Key point: The umask is subtractive. It removes permission bits from a default. The default for files is 666 (no execute bit), and the default for directories is 777. The umask is subtracted from these values. The result is the permission the new file or directory receives.

Why umask exists

The default-permission problem. A new file must have some permission. The kernel does not guess; it applies the default. The umask is how the user or the administrator controls what that default is.

The execute-bit problem. A new file should not be executable by default. A text file that is executable is a potential accident, and a downloaded script that is executable is a potential attack. The file default of 666 never includes the execute bit, and the umask does not add it.

The security problem. A user whose umask is 000 creates world-readable and world-writable files. A user whose umask is 077 creates files that only the user can read. The difference is a single shell setting, and the wrong setting exposes the user’s data.

The collaboration problem. A team that shares a directory needs the files created in it to be readable by the group. A umask of 002 produces 664 files and 775 directories, which give the group read and write access. A umask of 022 produces 644 files, which the group can read but not write.

The consistency problem. Different users on the same system have different umasks. A file created by one user may be readable by the group, and a file created by another may not. The umask is set per user, and the default comes from the system configuration.

The inheritance problem. A process inherits the umask from its parent. A shell that sets the umask affects every process the shell starts, and those processes affect their children. The umask is inherited, not inherited from a configuration file that the child reads.

The per-session problem. The umask is set per shell session. A user who logs in with a login shell gets the umask from the login configuration. A user who runs a subshell or a non-login shell may get a different value, depending on the shell and the configuration.

a. The umask calculation

The umask is a three- or four-digit octal number. The calculation subtracts it from the default permissions.

The defaults

Type	Default	Reason
File	666	Read and write for all, no execute
Directory	777	Read, write, and execute for all

The default is the maximum a new file or directory could have. The umask removes the bits that should not be set.

The subtraction

The subtraction is a bitwise AND with the complement of the umask. In practice, the result is the default with the umask’s bits cleared.

File:      666
umask:     022
result:    644

The 2 bits (write) are cleared from the group and others.
The 6 bits (read and write) are unchanged for the user.

The common umasks

umask	Files	Directories	Meaning
022	644	755	Owner read-write, others read
002	664	775	Owner read-write, group read-write
027	640	750	Owner read-write, group read
077	600	700	Owner only
007	660	770	Owner and group, no others
000	666	777	World-writable (dangerous)

The calculation table

umask	File Default	File Result	Directory Default	Directory Result
022	666	644	777	755
002	666	664	777	775
027	666	640	777	750
077	666	600	777	700
007	666	660	777	770
000	666	666	777	777

The bit positions

The umask has three digits, one per class.

Digit	Class	Bits
First	User	4 = read, 2 = write, 1 = execute
Second	Group	4 = read, 2 = write, 1 = execute
Third	Others	4 = read, 2 = write, 1 = execute

A 2 in the group position clears the group write bit. A 7 in the others position clears the read, write, and execute bits.

The four-digit form

A four-digit umask includes the special bits. The first digit is the setuid (4), setgid (2), and sticky (1) bits.

umask 0022

The leading 0 is the special-bits digit. The 022 is the standard mask. The special bits are rarely set in the umask.

The subtraction is not arithmetic

The calculation is a bitwise operation, not an arithmetic subtraction. The default minus the umask is the result in most cases, but the bitwise AND is the actual operation.

666 & ~022 = 644
777 & ~022 = 755

The ~022 is the complement of the umask, and the AND clears the masked bits.

b. The umask command

The umask command displays or sets the mask.

The display

umask
# 0022

The command prints the current umask in octal. The leading 0 is the special-bits digit.

The symbolic display

umask -S
# u=rwx,g=rx,o=rx

The -S flag prints the mask in symbolic form. The symbolic form shows what the permissions will be, not what is masked.

The symbolic set

umask u=rwx,g=rx,o=

The symbolic form sets the umask by specifying the allowed permissions for each class. The o= clears the others bits.

The octal set

umask 022
umask 077
umask 027

The octal form sets the mask directly. The setting applies to the current shell and every process it starts.

The session scope

The umask is a shell setting. It applies to the current session and every child process. When the shell exits, the setting is lost unless it is in a configuration file.

The login configuration

The umask is set in the shell’s startup files. For Bash, the files are /etc/profile, /etc/bash.bashrc, ~/.bash_profile, ~/.bashrc, and ~/.profile. The system-wide file sets the default, and the user file overrides it.

# /etc/profile
umask 022

# ~/.bashrc
umask 077

The pam_umask module

On systems with PAM, the pam_umask module sets the umask for the login session. The value is read from /etc/login.defs or from the user’s entry in /etc/passwd.

# /etc/login.defs
UMASK 022

The module applies the umask to the login session, and the shell’s configuration files may override it.

The per-user umask

The umask can be set per user in /etc/passwd or in the user’s shell configuration.

# /etc/passwd
alice:x:1000:1000:Alice:/home/alice:/bin/bash

The umask is not a field in /etc/passwd. The per-user setting comes from the shell configuration, the pam_umask module, or a custom script.

The effective umask

The effective umask is the value in effect when the file is created. The value is inherited from the parent process, and the shell’s configuration sets it for interactive sessions.

umask
# 0022

touch file.txt
ls -l file.txt
# -rw-r--r-- ... file.txt

The file is created with 644 because the umask is 022.

c. The common umask settings

The umask is chosen based on the user’s role and the system’s requirements. The common settings are 022, 002, 027, and 077.

The 022 umask

The 022 umask is the default on most systems. It produces 644 files and 755 directories. The owner has full access, and the group and others have read access.

umask 022
touch file.txt
mkdir dir
ls -l file.txt
ls -ld dir
# -rw-r--r-- ... file.txt
# drwxr-xr-x ... dir

The setting is appropriate for a single-user workstation and for files that are meant to be shared read-only.

The 002 umask

The 002 umask produces 664 files and 775 directories. The group has read and write access, and the others have read access.

umask 002
touch file.txt
mkdir dir
ls -l file.txt
ls -ld dir
# -rw-rw-r-- ... file.txt
# drwxrwxr-x ... dir

The setting is appropriate for a shared team directory where the group needs to edit the files.

The 027 umask

The 027 umask produces 640 files and 750 directories. The group has read access, and the others have no access.

umask 027
touch file.txt
mkdir dir
ls -l file.txt
ls -ld dir
# -rw-r----- ... file.txt
# drwxr-x--- ... dir

The setting is appropriate for a server where the files are read by the group but not by the world.

The 077 umask

The 077 umask produces 600 files and 700 directories. Only the owner has access.

umask 077
touch file.txt
mkdir dir
ls -l file.txt
ls -ld dir
# -rw------- ... file.txt
# drwx------ ... dir

The setting is appropriate for a user who works with sensitive data, such as SSH keys or credentials.

The 007 umask

The 007 umask produces 660 files and 770 directories. The owner and the group have read and write access, and the others have no access.

umask 007
touch file.txt
mkdir dir
ls -l file.txt
ls -ld dir
# -rw-rw---- ... file.txt
# drwxrwx--- ... dir

The setting is appropriate for a shared directory where the group is trusted and the world is not.

The setting table

Use Case	umask	Files	Directories
Default	022	644	755
Shared team	002	664	775
Server, group-readable	027	640	750
Private data	077	600	700
Group-only	007	660	770
World-writable	000	666	777

The `setgid` interaction

The setgid bit on a directory makes new files inherit the directory’s group. The umask does not affect the group ownership; it affects the permission bits.

chmod 2775 /srv/project
umask 002
touch /srv/project/file.txt
ls -l /srv/project/file.txt
# -rw-rw-r-- alice developers file.txt

The group is developers (from the setgid bit), and the permissions are 664 (from the umask).

The default ACL interaction

A default ACL on a directory overrides the umask for the files created inside it. The setfacl command sets the default ACL.

setfacl -d -m g:developers:rwx /srv/project
touch /srv/project/file.txt
getfacl /srv/project/file.txt
# group:developers:rwx

The default ACL takes precedence over the umask, which is the mechanism for a more granular permission scheme.

Complete Example Session

# ============================================
# PART 1: THE CURRENT UMASK
# ============================================

umask
# 0022

umask -S
# u=rwx,g=rx,o=rx

# ============================================
# PART 2: THE FILE CREATION
# ============================================

touch file.txt
ls -l file.txt
# -rw-r--r-- 1 alice alice 0 ... file.txt

# ============================================
# PART 3: THE DIRECTORY CREATION
# ============================================

mkdir dir
ls -ld dir
# drwxr-xr-x 2 alice alice 4096 ... dir

# ============================================
# PART 4: THE 077 UMASK
# ============================================

umask 077
touch private.txt
ls -l private.txt
# -rw------- 1 alice alice 0 ... private.txt

mkdir private-dir
ls -ld private-dir
# drwx------ 2 alice alice 4096 ... private-dir

# ============================================
# PART 5: THE 002 UMASK
# ============================================

umask 002
touch shared.txt
ls -l shared.txt
# -rw-rw-r-- 1 alice alice 0 ... shared.txt

# ============================================
# PART 6: THE 027 UMASK
# ============================================

umask 027
touch restricted.txt
ls -l restricted.txt
# -rw-r----- 1 alice alice 0 ... restricted.txt

# ============================================
# PART 7: THE PERSISTENT SETTING
# ============================================

echo 'umask 077' >> ~/.bashrc
# The setting applies to every new shell.

# ============================================
# PART 8: THE SYSTEM-WIDE SETTING
# ============================================

sudo echo 'umask 022' >> /etc/profile.d/umask.sh
# The setting applies to every login.

# ============================================
# PART 9: THE LOGIN.DEFS SETTING
# ============================================

grep UMASK /etc/login.defs
# UMASK 022

# The pam_umask module reads this value.

# ============================================
# PART 10: THE CALCULATION
# ============================================

umask 022
# File:      666 - 022 = 644
# Directory: 777 - 022 = 755

umask 077
# File:      666 - 077 = 600
# Directory: 777 - 077 = 700

The ten parts showed the current umask, the file creation, the directory creation, the 077 umask, the 002 umask, the 027 umask, the persistent setting, the system-wide setting, the login.defs setting, and the calculation.

Quick Reference

The umask Calculation

Default	umask	Result
666	022	644
666	002	664
666	027	640
666	077	600
777	022	755
777	002	775
777	027	750
777	077	700

The umask Command

Command	Purpose
`umask`	Show the current umask
`umask -S`	Show the symbolic form
`umask 022`	Set the umask
`umask u=rwx,g=rx,o=`	Set symbolically

The Configuration Files

File	Scope
`/etc/profile`	System-wide login
`/etc/profile.d/*.sh`	System-wide login
`/etc/bash.bashrc`	System-wide interactive
`~/.bash_profile`	Per-user login
`~/.bashrc`	Per-user interactive
`~/.profile`	Per-user login
`/etc/login.defs`	The `pam_umask` default

The Common Settings

umask	Use Case
022	Default
002	Shared team
027	Server, group-readable
077	Private data
007	Group-only

The File Types

Type	Default	Reason
File	666	No execute by default
Directory	777	Execute required to enter

Best Practices

✅ Do This:

# Set the umask in the shell configuration.
echo 'umask 022' >> ~/.bashrc  # ✅

# Use 077 for sensitive data.
umask 077  # ✅

# Use 002 for shared team directories.
umask 002  # ✅

# Verify the umask before creating files.
umask  # ✅

# Set the system-wide default.
echo 'umask 022' | sudo tee /etc/profile.d/umask.sh  # ✅

# Check the result with ls -l.
touch file.txt && ls -l file.txt  # ✅

# Use a default ACL for more granular control.
setfacl -d -m g:developers:rwx /srv/project  # ✅

❌ Don’t Do This:

# Don't use umask 000.
umask 000  # ❌ World-writable files

# Don't expect the umask to affect existing files.
umask 077  # ❌ Only affects new files

# Don't set the umask in a non-login shell only.
# The setting is lost when the shell exits.  # ❌

# Don't forget the umask is inherited.
# A child process inherits the parent's value.  # ❌

# Don't use the umask to make a file executable.
# The execute bit is never set by the umask.  # ❌

# Don't rely on the umask for security alone.
# Use the file permissions as the primary control.  # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Files are world-readable	umask 022	Use 077 for private
Group cannot write	umask 022	Use 002 for shared
Execute bit missing	Default is 666	`chmod +x`
Setting not persistent	Set in the shell only	Add to `~/.bashrc`
Different value in login	Non-login shell	Set in all config files
Setting lost on logout	Session scope	Use the config file
Default ACL ignored	No default ACL	Use `setfacl -d`

Real-World Examples

1. Show the Umask

umask

2. Symbolic Display

umask -S

3. Set to 022

umask 022

4. Set to 077

umask 077

5. Set to 002

umask 002

6. Persistent Setting

echo 'umask 022' >> ~/.bashrc

7. System-Wide Setting

echo 'umask 022' | sudo tee /etc/profile.d/umask.sh

8. The login.defs

grep UMASK /etc/login.defs

9. Verify the Result

touch file.txt && ls -l file.txt

10. Default ACL

setfacl -d -m g:developers:rwx /srv/project

Visual

The umask Calculation

┌────────────────────────────────────────────────────────────┐
│  THE umask CALCULATION                                     │
│                                                            │
│  FILE                                                      │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Default:  666  (rw-rw-rw-)                       │     │
│  │  umask:    022  (----w--w-)                       │     │
│  │  Result:   644  (rw-r--r--)                       │     │
│  │                                                   │     │
│  │  The write bits are cleared from the group        │     │
│  │  and the others. The read bits are unchanged.     │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  DIRECTORY                                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Default:  777  (rwxrwxrwx)                       │     │
│  │  umask:    022  (----w--w-)                       │     │
│  │  Result:   755  (rwxr-xr-x)                       │     │
│  │                                                   │     │
│  │  The write bits are cleared from the group        │     │
│  │  and the others. The read and execute bits        │     │
│  │  are unchanged.                                   │     │
│  └──────────────────────────────────────────────────┘     │
└────────────────────────────────────────────────────────────┘

The Common umasks

┌────────────────────────────────────────────────────────────┐
│  THE COMMON umasks                                         │
│                                                            │
│  umask 022                                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Files:  644  (rw-r--r--)                         │     │
│  │  Dirs:   755  (rwxr-xr-x)                         │     │
│  │  Use:    Default, single-user workstation         │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  umask 002                                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Files:  664  (rw-rw-r--)                         │     │
│  │  Dirs:   775  (rwxrwxr-x)                         │     │
│  │  Use:    Shared team directory                    │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  umask 077                                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Files:  600  (rw-------)                         │     │
│  │  Dirs:   700  (rwx------)                         │     │
│  │  Use:    Private data, SSH keys                   │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  umask 027                                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Files:  640  (rw-r-----)                         │     │
│  │  Dirs:   750  (rwxr-x---)                         │     │
│  │  Use:    Server, group-readable                   │     │
│  └──────────────────────────────────────────────────┘     │
└────────────────────────────────────────────────────────────┘

The umask Inheritance

┌────────────────────────────────────────────────────────────┐
│  THE umask INHERITANCE                                     │
│                                                            │
│  LOGIN SHELL                                               │
│  ┌──────────────────────────────────────────────────┐     │
│  │  umask 022                                        │     │
│  │    (from /etc/profile)                            │     │
│  └────────────────────────┬─────────────────────────┘     │
│                           │                                │
│                           │  Inherited                    │
│                           v                                │
│  INTERACTIVE SHELL                                         │
│  ┌──────────────────────────────────────────────────┐     │
│  │  umask 022                                        │     │
│  │    (from ~/.bashrc)                               │     │
│  └────────────────────────┬─────────────────────────┘     │
│                           │                                │
│                           │  Inherited                    │
│                           v                                │
│  CHILD PROCESS                                             │
│  ┌──────────────────────────────────────────────────┐     │
│  │  umask 022                                        │     │
│  │    (inherited from the shell)                     │     │
│  │                                                   │     │
│  │  Files created: 644, directories: 755             │     │
│  └──────────────────────────────────────────────────┘     │
└────────────────────────────────────────────────────────────┘

The setgid Interaction

┌────────────────────────────────────────────────────────────┐
│  THE setgid INTERACTION                                    │
│                                                            │
│  /srv/project  (drwxrwsr-x, group: developers)             │
│                                                            │
│  ┌──────────────────────────────────────────────────┐     │
│  │  alice (primary group: alice) creates a file.     │     │
│  │                                                   │     │
│  │  Without setgid:                                  │     │
│  │    -rw-r--r-- alice alice file.txt (umask 022)    │     │
│  │                                                   │     │
│  │  With setgid on the directory:                    │     │
│  │    -rw-r--r-- alice developers file.txt           │     │
│  │                                                   │     │
│  │  The group is inherited from the directory.       │     │
│  │  The umask still controls the permission bits.    │     │
│  └──────────────────────────────────────────────────┘     │
└────────────────────────────────────────────────────────────┘

Summary

Item	Value
umask	The default permission mask
Default file	666
Default directory	777
umask 022	644 files, 755 directories
umask 002	664 files, 775 directories
umask 027	640 files, 750 directories
umask 077	600 files, 700 directories
`umask`	The command to show or set
`umask -S`	The symbolic display
`/etc/profile.d/`	The system-wide configuration
`~/.bashrc`	The per-user configuration

Key takeaways:

The umask is a subtractive mask. It removes permission bits from the default. The default for a file is 666 and for a directory is 777. The umask is subtracted from the default to produce the actual permission.
The execute bit is never set by the umask. The file default of 666 does not include the execute bit, and the umask does not add it. A file that must be executable requires an explicit chmod +x.
The umask is per session and inherited. The setting applies to the current shell and every process it starts. The value is inherited from the parent, and the shell’s configuration files set it for interactive sessions.
The common umasks serve different purposes. 022 is the default for single-user workstations, 002 is for shared team directories, 027 is for servers, and 077 is for private data.
The umask is set in the shell configuration files. The system-wide setting is in /etc/profile and /etc/profile.d/. The per-user setting is in ~/.bashrc or ~/.bash_profile. The pam_umask module reads /etc/login.defs for the login session.
The setgid bit and the umask work together. The setgid bit on a directory determines the group of new files, and the umask determines their permission bits. The two settings are independent.
A default ACL overrides the umask. A default ACL on a directory sets the permissions for new files inside it, regardless of the umask. The setfacl -d command sets the default ACL.
The umask is a default, not a security control. The umask controls the permissions of new files, but the file permissions themselves are the primary control. A user who needs a file to be private should set the permissions explicitly, not rely on the umask.

Remember: The umask is the mask that determines the default permissions of every file and directory a user creates. It is subtracted from the default of 666 for files and 777 for directories, and the result is the actual permission. The umask is set per session and inherited by child processes, and it is configured in the shell’s startup files. The common values are 022, 002, 027, and 077, each suited to a different use case. The setgid bit and the default ACL interact with the umask, and the combination determines the final permissions. The result is a system where every new file starts with a predictable permission, and where the default is chosen by the user or the administrator.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

Why umask exists

a. The umask calculation

The defaults

The subtraction

The common umasks

The calculation table

The bit positions

The four-digit form

The subtraction is not arithmetic

b. The umask command

The display

The symbolic display

The symbolic set

The octal set

The session scope

The login configuration

The pam_umask module

The per-user umask

The effective umask

c. The common umask settings

The 022 umask

The 002 umask

The 027 umask

The 077 umask

The 007 umask

The setting table

The setgid interaction

The default ACL interaction

Complete Example Session

Quick Reference

The umask Calculation

The umask Command

The Configuration Files

The Common Settings

The File Types

Best Practices

Common Pitfalls

Real-World Examples

1. Show the Umask

2. Symbolic Display

3. Set to 022

4. Set to 077

5. Set to 002

6. Persistent Setting

7. System-Wide Setting

8. The login.defs

9. Verify the Result

10. Default ACL

Visual

The umask Calculation

The Common umasks

The umask Inheritance

The setgid Interaction

Summary

The `setgid` interaction