Linux commands: umask

When you create a file, you don’t have to decide permissions up front. Permissions have defaults.

Those defaults can be controlled and modified using the umask command.

Typing umask with no arguments will show you the current umask, in this case 0022:

What does 0022 mean? That’s an octal value that represent the permissions.

Another common value is 0002.

Use umask -S to see a human-readable notation:

umask -S shows what’s left allowed after the mask. The umask itself removes bits from the permissions a program asks for.

Most programs create files with 666 (read and write for everyone) and directories with 777. With 0022, new files get 644 (rw-r--r--) and new directories get 755 (rwxr-xr-x). New regular files don’t get the execute bit from the umask.

In the numeric notation, we typically change the last 3 digits.

Each digit is what the mask removes. The list shows what’s left allowed:

• 0 read, write, execute
• 1 read and write
• 2 read and execute
• 3 read only
• 4 write and execute
• 5 write only
• 6 execute only
• 7 no permissions

This numeric notation is the complement of chmod. umask 022 gives files 644 and directories 755.

We can set a new value for the mask setting the value in numeric format:

umask 002

or you can change a specific role’s permission:

umask g+r

This only applies to files you create from now on. Existing files stay as they are. Use chmod to change those.

0022 (often written 022) is the usual default: the owner can write, the group and others cannot. 0002 lets the group write too. Use that in a shared project folder, so people in the same group can edit each other’s new files.

umask is a shell builtin. It only affects the current shell and the processes it starts. To keep a value, add it to ~/.zshrc or ~/.bashrc.

The umask command works on Linux, macOS, WSL, and anywhere you have a UNIX environment

Want me to talk about your product? You can sponsor this site.