What umask is and how it works

The umask, short for user file-creation mask, decides which permissions a newly created file or directory does not get. It is set per process with the umask shell built-in (or the umask() system call) and is inherited by every program started from that shell.

To read a umask you first need to read Linux permissions.

Linux permissions in octal

Permissions are three groups of three bits: one group for the owner, one for the file’s group and one for everyone else.

777 = rwx rwx rwx
644 = rw- r-- r--
      │   │   └─ others
      │   └───── group
      └───────── owner

Each digit is the sum of the permissions it grants:

So 7 is read, write and execute (4 + 2 + 1), 6 is read and write, 5 is read and execute, and 0 is nothing.

How the umask is applied

Programs usually ask for mode 666 when they create a file and 777 when they create a directory. The kernel then removes every permission bit that is set in the umask. For the common umask 022:

With umask 027, other users get no access at all: new files are 640 and new directories 750.

The umask can only take permissions away; it never adds any. “Subtracting” the umask is a handy shortcut but not quite right: with a requested mode of 666 and a umask of 007 the result is 660, while plain subtraction would give 659, which is not even a valid mode.

Why it matters

A sensible umask is one of the simplest ways to keep newly created files from being readable by everyone on a shared system. It does not change files that already exist; use chmod for those.