Understanding umask and Default Permissions on Linux
What Is umask?
When you create a new file or directory on Linux, the system assigns it default permissions. The umask (user file-creation mode mask) determines what those defaults are by subtracting permission bits from the base creation mode.
A umask of 022 means newly created files get 644 (rw-r--r--) and directories get 755 (rwxr-xr-x). The umask does not grant permissions — it removes them.
How umask Calculation Works
Base Creation Modes
Programs request permissions when creating files:
- Files: base mode
0666(rw-rw-rw-) - Directories: base mode
0777(rwxrwxrwx)
The umask subtracts bits from these base values.
Subtraction Example
With umask 022:
File: 0666 - 0022 = 0644 (rw-r--r--)
| Category | Base | umask | Result |
|---|---|---|---|
| Owner | rw- | --- | rw- |
| Group | rw- | -w- | r-- |
| Others | rw- | -w- | r-- |
Directory: 0777 - 0022 = 0755 (rwxr-xr-x)
| Category | Base | umask | Result |
|---|---|---|---|
| Owner | rwx | --- | rwx |
| Group | rwx | -w- | r-x |
| Others | rwx | -w- | r-x |
Note that umask uses the same octal values as chmod: read=4, write=2, execute=1.
Common umask Values
| umask | File Permissions | Directory Permissions | Use Case |
|---|---|---|---|
| 022 | 644 (rw-r--r--) | 755 (rwxr-xr-x) | Default on most Linux systems |
| 027 | 640 (rw-r-----) | 750 (rwxr-x---) | More restrictive group access |
| 077 | 600 (rw-------) | 700 (rwx------) | Private: no group or others access |
| 002 | 664 (rw-rw-r--) | 775 (rwxrwxr-x) | Shared group collaboration |
| 000 | 666 (rw-rw-rw-) | 777 (rwxrwxrwx) | No restrictions (dangerous) |
Checking and Setting umask
Check Current umask
umask
# Output: 0022
# Symbolic output (more readable)
umask -S
# Output: u=rwx,g=rx,o=rx
Set umask Temporarily
# More restrictive for this session
umask 077
# Verify
umask
# Output: 0077
This change lasts only for the current shell session.
Set umask Permanently
Add the umask command to your shell configuration:
# For bash
echo "umask 027" >> ~/.bashrc
# For zsh
echo "umask 027" >> ~/.zshrc
System-Wide Default
The system default is typically set in /etc/profile or /etc/login.defs. Changing this affects all users.
umask vs chmod
| Aspect | umask | chmod |
|---|---|---|
| When it applies | When files/directories are created | On existing files/directories |
| Direction | Removes permissions from base | Sets permissions directly |
| Persistence | Affects all future creations in session | One-time change on target |
| Scope | Process-level setting | File-level setting |
Use umask to set policy for new files. Use chmod to fix permissions on existing files.
Special Permission Bits
The umask can also affect setuid (4), setgid (2), and sticky bit (1). A four-digit umask like 0022 includes the special bits mask as the first digit.
Most users never need to adjust these via umask. The special bits are typically set with chmod after creation:
# Set setgid on a directory (new files inherit group)
chmod 2775 /shared/project
# Set sticky bit on a directory (only owner can delete files)
chmod 1777 /tmp
Web Server Considerations
For web servers, umask directly affects security:
# Secure umask for web deployments
umask 027
# Result: files created as 640 (owner rw, group r, others nothing)
# Directories created as 750 (owner rwx, group rx, others nothing)
This prevents the "others" category from reading web files — the web server runs as the owner or group, while other system users have no access.
Key Takeaways
- umask subtracts permission bits from the base creation mode (0666 for files, 0777 for directories)
- Default umask 022 produces files at 644 and directories at 755
- Set umask 077 for private environments, 027 for restricted group access, 002 for shared collaboration
- umask affects only new files; use chmod for existing ones
- Add umask to shell config files for persistent settings
- Web servers should use restrictive umask values (027 or 077) to limit file exposure
Try It Yourself
Calculate permission values and understand the relationship between umask and chmod using our chmod Calculator. Toggle permission bits interactively and see numeric, symbolic, and binary representations side by side.
Related Guides
- chmod Guide — complete reference for the chmod command
- Linux File Permissions — deep dive into the owner/group/others model