Umask

umask (abbreviated from "user mask") is a command and a function in POSIX environments which set the default permission modes for newly created files and directories of the current process.

Modern Unix systems allow umasks to be specified in 2 ways
* A default permission, also called a Symbolic Umask. Eg. u=rwx,g=rwx,o=
* An octal number that controls which permissions will masked (not set) for any newly created file. Eg, 007.

In both cases bear in mind that most Unix systems do not allow new files to be created with execute permission turned on, regardless of the umask.

Symbolic Umasks

A umask set to u=rwx,g=rwx,o= will result in new files having the modes rw-rw----, and new directories having the modes rwxrwx---.

Symbolic Umask Example

In bash:

$ umask u=rwx,g=rwx,o= $ mkdir foo $ touch bar $ ls -l drwxrwx--- 2 dave dave 512 Sep 1 20:59 foo -rw-rw---- 1 dave dave 0 Sep 1 20:59 bar

Octal Umasks

Octal umasks are calculated via the bitwise AND of the unary complement of the argument (using bitwise NOT) and the full access mode.

The changes will take effect during the current session only.

The full access mode is 666 in the case of files, and 777 in the case of directories.Most Unix shells provide a umask command that affects all child processes executed in this shell.

A common umask value is 022 (masking out the write permission for the "group" and "others"), which ensures that new files are only writable for the owner (i.e. the user who created them). Another common value is 002, which leaves the write permission for the file's "group" enabled. This can be used for files in shared workspaces, where several users work with the same files.

Octal Umask Examples

Assuming the umask has the value "174", any new file will be created with the permissions "602" and any new directory will have permissions "603" because:

666_"8" AND NOT(174_"8") = 602_"8"

while

777_"8" AND NOT(174_"8") = 603_"8"

777_"8" = (111 111 111)_"2" 174_"8" = (001 111 100)_"2" NOT(001 111 100)_"2" = (110 000 011)_"2" (111 111 111)_"2" AND (110 000 011)_"2" = (110 000 011)_"2" 777_"8" NOT (174)_"8" (603)_"8"

In bash:

$ umask 0174 $ mkdir foo $ touch bar $ ls -l drw-----wx 2 dave dave 512 Sep 1 20:59 foo -rw-----w- 1 dave dave 0 Sep 1 20:59 bar

Using the above mask, octal 1 prevents user execute bit being set, octal 7 prevents all group bits being set, and octal 4 prevents the read bit being set for others.

Tips

* When using umask be aware that it only affects the user you are currently logged in as.
* If you're using (S)FTP you must restart the (S)FTP deamon after you have set a umask. Additionally, you must re-connect to the server in order for the umask to take affect.

See also

* chmod

External links

* [http://www.openbsd.org/cgi-bin/man.cgi?query=umask&sektion=2 Manpage of umask(2)] from OpenBSD
* [http://www.gnu.org/software/libc/manual/html_node/Setting-Permissions.html "Setting Permissions"] from "The GNU C Library Reference Manual"
* [http://www.lockergnome.com/linux/2002/08/29/the-users-mask/ "UMask details"]