What Is Umask and How Does It Work in Linux?

The user mask, commonly known as umask, is a Linux environment setting that determines the default permission bits assigned to newly created files and directories. Instead of granting permissions directly, umask acts as a filter that restricts specific access rights—read, write, or execute—from standard system-wide defaults. Understanding how umask calculates these values is essential for managing file security and multi-user environments in the Linux operating system.

Base Permissions in Linux

When a new file or directory is generated, the operating system starts with standard baseline permissions before the umask is applied:

• Directories: Start with a base permission of 0777 (rwxrwxrwx), granting full read, write, and execute rights to owner, group, and others. Directories require execute permissions so users can enter them and access their contents.
• Files: Start with a base permission of 0666 (rw-rw-rw-), granting read and write rights to everyone. By default, Linux does not assign execute permissions to newly created regular files for security reasons.

How Umask Determines Permissions

The umask value represents the permissions you want to remove or mask out from the base permissions. It uses standard octal permission values:

• 4: Read permission (r)
• 2: Write permission (w)
• 1: Execute permission (x)
• 0: No permissions removed

In basic practice, the effective permission is calculated by subtracting the umask value from the base permission.

Example Calculation with Umask 022

The most common default umask on Linux distributions is 0022 (or simply 022):

• For a Directory: 0777 - 0022 = 0755 (rwxr-xr-x). The owner has read, write, and execute permissions, while group members and other users can only read and execute (traverse) the directory.
• For a File: 0666 - 0022 = 0644 (rw-r--r--). The owner can read and write to the file, while group members and others can only read it.

Example Calculation with Umask 027

In environments requiring stricter privacy, a umask of 027 is often applied:

• For a Directory: 0777 - 0027 = 0750 (rwxr-x---). The owner has full control, group members can read and execute, and others have zero access.
• For a File: 0666 - 0027 = 0640 (rw-r-----). The owner has read and write access, the group has read-only access, and others cannot access the file.

(Note: Under the hood, Linux uses a bitwise NOT operation followed by a bitwise AND between the base permission and the mask: Mode = Base & (~Umask).)

Viewing and Setting Umask

To view your current shell session's umask, open a terminal and run:

umask

To display the active permissions symbolically rather than in octal format, run:

umask -S

To temporarily change the umask for your active shell session, pass the desired octal value:

umask 0077

With 0077, any new file created in that session will receive 0600 (rw-------) permissions, making it completely private to the file owner.

Making Umask Changes Permanent

To ensure a custom umask applies automatically whenever a user logs in, the command can be declared inside user profile configuration files:

• Per-user: Add umask 027 (or your chosen value) to ~/.bashrc, ~/.bash_profile, or ~/.profile.
• System-wide: Modify default mask settings in /etc/profile, /etc/bash.bashrc, or /etc/login.defs (via the UMASK parameter), which establishes system-wide security baselines for all accounts.