What is Umask and How to Use it

Umask, or the user file-creation mode, is a Linux command that is used to assign the default file permission sets for newly created folders and files. The term mask references the grouping of the permission bits, each of which defines how its corresponding permission is set for newly created files. The bits in the mask may be changed by invoking the umask command.

When using the term Umask, we are referring to one of the following two meanings:

• The user file creation mode mask that is used to configure the default permissions for newly created files and directories
• The command “umask” which is used to set the umask value

As you probably already know, all Unix-based operating systems have a set of properties that are used to define who is allowed to read, write, or execute specific files or directories. There are three categories called “permissions classes” to which these permissions apply, and they are noted as follows.

• User: The User, by default, is the owner or creator of a file or folder. The ownership of the new file defaults to this user.
• Group: A Group is a set of users that share the same access level or permissions to a file or folder.
• Other: The Other group is defined as any user not included in the previous two categories. These users have not created a file or folder, nor do they belong to a specific usergroup. This group includes everyone not identified as a user or as being part of an usergroup. When we set the permission level of a file or folder to Other, it gives permissions level access to anyone that accesses the file or folder.

So, what happens when a user creates new files and directories? The system automatically assigns the following permissions a file if using the touch command.

[root@host ~]# touch test.txt
[root@host ~]# stat test.txt
  File: test.txt
  Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: fd03h/64771d Inode: 654750 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2020-04-21 12:53:25.612051178 -0400
Modify: 2020-04-21 12:53:25.612051178 -0400
Change: 2020-04-21 12:53:25.612051178 -0400
 Birth: -

If we create a directory, it assigns the following permission set to it,

[root@host ~]# mkdir test
[root@host ~]# stat test
  File: test
  Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: fd03h/64771d Inode: 654751 Links: 2
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2020-04-21 12:54:25.172601585 -0400
Modify: 2020-04-21 12:54:25.172601585 -0400
Change: 2020-04-21 12:54:25.172601585 -0400
 Birth: -
[root@host ~]#

The Umask Command Syntax

The complete manpage entry for umask is as follows.

umask [-p] [-S] [mode]
The user file-creation mask is set to mode.  

If mode begins with a digit, it is interpreted as an octal number; otherwise it is interpreted as a symbolic mode mask similar to that accepted by  chmod(1). If mode is omitted, the current value of the mask is printed.  

The -S option causes the mask to be printed in symbolic form; the default output is an octal number. 

If the -p option is supplied, and mode is omitted, the output is in a form that may be reused as input. The return status is 0 if the mode was successfully changed or if no mode argument was supplied, and false otherwise.

To view the current umask value, we use the umask command. Running the umask command by itself provide the default permissions that are assigned when a file or folder is created.

[root@host ~]# umask
0022
[root@host ~]#

To change these values, we will use the following command.

[root@host ~]# umask ###
[root@host ~]# umask 022

The ### symbols in the first command are used in lieu of an actual octal number.

Below, we can see the translated values of the octal and how they are related.

So, when we run a ls command, the octal or symbolic permissions values are shown at the beginning of the output.

[root@host ~]# ls
drwxr-xr-x 2 root root 4096 Apr 21 12:54 test/
-rw-r--r-- 1 root root    0 Apr 21 12:53 test.txt

The permissions set for the test directory is 755 or ‘rwx’ ‘r-x’ ‘r-x’.
The permissions set for the test.txt file is 644 or ‘rw -‘ ‘r – -‘ ‘r – -‘.
A dash signifies a 0 value.

Symbolic Headings

--- no permission
--x execute
-w- write
-wx write and execute
r-- read
r-x read and execute
rw- read and write
rwx read, write and execute

Numeric Headings

0 --- no permission
1 --x execute
2 -w- write
3 -wx write and execute
4 r-- read
5 r-x read and execute
6 rw- read and write
7 rwx read, write and execute

How Umask Works

The umask command masks permission levels by qualifying them with a certain value. To explain further how the umask value is applied, we will illustrate with an example. Let’s say that we want to set the default permissions for all new files or folders to 644 and 755. We would then use the following command.

[root@host ~]# umask 022

The number “2” permission (write permission) will be “filtered” from the system’s default permissions of 666 and 777 (hence the name “mask.”) From now on, the system will now assign the default permissions of 644 and 755 on new files and directories. Simply put, to calculate the permission bits for a new file or directory, we just subtract the umask value from the default value, like so.

• 666 – 022 = 644
• 777 – 022 = 755

Octal value : Permission

• 0 : read, write and execute
• 1 : read and write
• 2 : read and execute
• 3 : read only
• 4 : write and execute
• 5 : write only
• 6 : execute only
• 7 : no permissions

We can use above information to calculate our file permissions. For example, if our umask is set to 077, the permission can be calculated as follows:

0 : read, write and execute
7 : no permissions
7 : no permissions

A umask of 000 will make newly created directories readable, writable and executable by everyone (the permissions will be 777).

Umask Configuration Location

In most Linux distributions, the umask value can be found and configured in the following locations:

• /etc/profile – this is where system-wide default variables are stored
• /etc/bash.bashrc – this is where default shell configuration files are stored

Umask Symbols

As noted in the umask man page above, we can use specific symbols to specify permission values we want to set. To preview the currently set umask value in symbols, we use the following command:

umask -S

To change it, we can use the command in which the letters “u,” “g,” and “o” represent the user, group, and other or world, as shown below.

umask u=$, g=$, o=$

When settings permissions this way, we supplement each “$” placeholder with the desired permission symbol(s). The equal “=” sign is not the only operator at our disposal when setting umask with symbolic values. We can use plus “+” and minus “–” operators as well.

• The = symbol allows permissions to be enabled, prohibiting unspecified permissions
• The + symbol allows permissions to be enabled, ignoring unspecified permissions
• The – symbol prohibits permissions from being enabled, ignoring unspecified permissions

umask a=

Conclusion

Now that we better understand the function of the user file mode creation mask, we can put it to good use. Not only does it save us precious time and improve security, but it also provides us with better permission management capabilities.