umask — the mask for new files and directories
umask is a process mask: which permissions to remove from a new file (from 666) and directory (from 777).
Cheat sheet
6 commands Printable version-
umaskthe current mask: 0002 or 0022 -
umask -Sthe same in letters: u=rwx,g=rwx,o=rx -
umask 027mask for this shell and its children -
touch f; mkdir d; ls -ld f dcheck it on new files -
grep -E '^(UMASK|USERGROUPS_ENAB)' /etc/login.defs -
sudo sh -c umaska root command's mask: 0022
Overview
A program that creates a file asks for permissions: usually 666 (rw-rw-rw-) for a
file and 777 (rwxrwxrwx) for a directory. The umask is a process
mask: the kernel removes its bits from the requested permissions. Existing files are
not affected.
| Mask | File | Directory | Who can write |
|---|---|---|---|
022 |
644 rw-r--r-- |
755 rwxr-xr-x |
the owner only |
002 |
664 rw-rw-r-- |
775 rwxrwxr-x |
the owner and the group |
027 |
640 rw-r----- |
750 rwxr-x--- |
the owner; the group reads |
077 |
600 rw------- |
700 rwx------ |
the owner only, others get nothing |
It is not subtraction but bit clearing: with a mask of 033 a file gets 644, not
633. The mask never gives a file x — that takes chmod +x.
Where the mask comes from
Every process inherits the mask from its parent. On Ubuntu it is set at login:
/etc/login.defs:UMASK 022— the default mask;USERGROUPS_ENAB yesin the same file: if the user has a personal group with the same name, the PAM modulepam_umask(a line in/etc/pam.d/common-session) gives the group the same rights as the owner, which makes002. The rule does not apply to root, whose mask is022;~/.profileand~/.bashrccan override it with a line likeumask 027. Ubuntu's~/.profilealready has one, commented out:#umask 022.
systemd services do not inherit a user's mask: they get it from the unit (UMask=).
Recipes
4A team's shared directory
For files to also get the directory's group instead of yours, the directory needs the
setgid bit. The mask works per user: if a colleague has 022, their
files are not group-writable.
A service's mask
A line in the unit or in a drop-in (sudo systemctl edit app) — see systemd.
Create one file with the right permissions
Troubleshooting
5Files in a shared directory are not group-writable
The creator's mask is 022: this happens for root (and sudo without -u), for
services, and at a login where ~/.profile sets umask 022. Check umask in the
shell where the file is created. For files that already exist, use chmod g+w.
Which mask a command run as another user gets
sudo -u alice opens a PAM session, and pam_umask sets alice's mask:
sudo -u alice sh -c umask prints 0002. sudo -iu alice also reads her
~/.profile, and a umask line there wins. runuser does not call pam_umask, so
runuser -l alice -c umask prints 0022.
The mask changed, but old files are the same
The mask applies only at creation. Permissions of existing files are changed with chmod.
A new script is not executable
The mask never gives files x. After creating a script, run chmod +x script.sh.
bash: umask: 9: octal number out of range
The mask uses octal digits 0–7: 022, 027, 077.
Danger zone
1umask 000
New files get 666 and directories 777 — any user on the machine can write to them.
Every child process inherits the mask, so such a line in your profile opens
everything you create.
See also
- permissions — reading rwx and numeric modes.
- chmod-chown — change the permissions and group of existing files.
- special-bits — the setgid directory: new files get its group.
- users-groups — a user's personal and supplementary groups.
- sudo — commands as another user.
- bash — startup files where umask is set.
Found an inaccuracy? Report an error in the article