umask in Linux: Default Permissions Explained

Create a file and it arrives with permissions you did not choose — usually 644, sometimes 755 for directories. umask is why: a per-process setting that shaves bits off the system defaults every time a file is born.

Where 644 comes from #

Files start from 666 and directories from 777; umask subtracts. A mask of 022 removes group- and other-write:

$ umask
0022
$ touch newfile && ls -l newfile
-rw-r--r-- 1 ana ana 0 Oct 21 newfile

666 minus 022 leaves 644 — owner reads and writes, everyone else reads. Directories: 777 minus 022 is 755, keeping the traverse bit.

Setting your own #

$ umask 077        # files 600, dirs 700 — private to you
$ umask 027        # group read, others nothing

Octal read: first digit owner, second group, third others; each digit is r(4)w(2)x(1) to remove. Or read it symbolically — umask u=rwx,g=,o= is 077 in words.

Making it persist #

umask is inherited by child processes, so the shell startup file is the usual home — umask 027 in ~/.bashrc covers interactive sessions. System-wide defaults live in /etc/login.defs and PAM's pam_umask; systemd services get theirs from the unit or the global default, which is why a service's files can arrive with different permissions than your shell's:

$ systemctl show aospix-notify -p UMask
UMask=0027

Related: chmod for changing what exists, ACLs when three permission classes are not enough. More in the terminal notes series.