Default Permissions: umask
umask sets the permissions that new files and directories start with.
Syntax
umask [mask]When you create a file it is given default permissions. The umask decides those defaults by specifying which permissions to remove from the maximum.
How the maths works
The base is 666 for files and 777 for directories. The umask is subtracted from that. A typical umask of 022 gives:
- Files: 666 − 022 = 644 (rw-r--r--).
- Directories: 777 − 022 = 755 (rwxr-xr-x).
A stricter umask of 077 makes new files private to you (600) — useful on shared servers.
Example
# Show the current mask
umask
# 0022
# Make new files private (owner only)
umask 077
touch private.txt
ls -l private.txt
# -rw------- 1 alice alice 0 Jul 15 private.txtWhen to use it
- A security-conscious sysadmin sets 'umask 027' in '/etc/profile' so newly created files are not world-readable by default.
- A developer checks the current umask with 'umask' when newly created files have unexpected permissions during a build process.
- A shared-server admin uses 'umask 002' for a shared group so new files are group-writable, enabling team collaboration.
More examples
View and understand umask
Shows the default umask and explains how it subtracts permission bits from the system defaults.
umask
# 0022
# Files default to 666, directories to 777
# Umask 022 removes write from group and others
# Files get: 666 - 022 = 644 (rw-r--r--)
# Dirs get: 777 - 022 = 755 (rwxr-xr-x)Change umask for stricter privacy
Sets umask 077 so newly created files are readable only by the owner, removing all group and other bits.
# Set restrictive umask (no group or other permissions)
umask 077
touch private.txt
ls -l private.txt
# -rw------- 1 alice alice 0 Jul 16 private.txtPersist umask in shell config
Shows how to make a umask setting permanent by adding it to ~/.bashrc.
# Add to ~/.bashrc to apply for every interactive session
echo 'umask 027' >> ~/.bashrc
# Apply immediately in current session
umask 027
# Verify
umask
# 0027
Discussion