umask Command — Controlling Default File and Directory Permissions¶

The umask (User File Creation Mask) command determines the default permissions assigned to newly created files and directories. Instead of adding permissions, umask removes permissions from the system defaults. Understanding umask is essential for Linux security, DevOps automation, cloud infrastructure, and production system administration.

Learning Path¶

Linux Mastery → Module 4: File Management and Permissions → Lesson 6

Difficulty: Intermediate

Reading Time: 45 Minutes

Course Progress

Course: Linux Mastery

Module: File Management and Permissions

Lesson: 6 of 10

What You'll Learn¶

After completing this lesson, you'll be able to:

Understand the purpose of umask
View the current umask value
Calculate default permissions
Change the umask temporarily
Configure permanent umask values
Apply security best practices
Troubleshoot permission-related issues

Prerequisites¶

Complete:

Module 1
Module 2
Module 3
Module 4 Lessons 1–5

Why Learn umask?¶

Imagine you're deploying an application.

A configuration file is created automatically.

Instead of:

rw-------

it becomes:

rw-rw-rw-

Now every user on the system can modify it.

This is a serious security risk.

The default permissions are controlled by umask.

What is umask?¶

umask stands for:

User File Creation Mask

It defines which permissions should NOT be assigned when creating new files and directories.

Important:

umask removes permissions—it does not grant permissions.

How Default Permissions Work¶

Linux starts with these defaults:

Files¶

666

rw-rw-rw-

Why not 777?

Regular files are not executable by default for security reasons.

Directories¶

777

rwxrwxrwx

Directories require execute permission for traversal.

The Permission Formula¶

Default Permission

        -

     umask

----------------

Final Permission

Example: umask 022¶

Current mask:

umask

Output:

For files:

666

-022

----

644

Result:

rw-r--r--

For directories:

777

-022

----

755

Result:

rwxr-xr-x

Example: umask 027¶

Files:

666

-027

----

640

Directories:

777

-027

----

750

Example: umask 077¶

Files:

666

-077

----

600

Directories:

777

-077

----

700

This is commonly used for sensitive environments.

Viewing Current umask¶

umask

Example:

Display symbolic format:

umask -S

Output:

u=rwx,g=rx,o=rx

Changing umask Temporarily¶

Set:

umask 027

Verify:

umask

Create a file:

touch test.txt

Check:

ls -l test.txt

Output:

-rw-r-----

Changing umask Permanently¶

User-specific:

~/.bashrc

~/.profile

~/.bash_profile

Example:

umask 027

Reload:

source ~/.bashrc

System-wide:

Depending on the Linux distribution:

/etc/profile

/etc/bash.bashrc

/etc/login.defs

Note

Always verify your distribution's documentation before changing system-wide defaults.

Common umask Values¶

umask	Files	Directories	Typical Use
000	666	777	Testing only
002	664	775	Team collaboration
022	644	755	Default on many Linux systems
027	640	750	Shared production environments
077	600	700	High-security systems

Demonstration¶

Current:

umask 022

Create:

touch file1

mkdir dir1

Check:

ls -ld file1 dir1

Output:

-rw-r--r--

drwxr-xr-x

Change:

umask 077

Create:

touch secret.txt

mkdir secrets

Output:

-rw-------

drwx------

Understanding the Calculation¶

Example:

Default File

666

umask

022

Final

644

Notice:

6 = rw-

2 removes write permission

Result:

r--

Think of umask as blocking permissions, not assigning them.

Common Commands¶

Display:

umask

Symbolic format:

umask -S

Set:

umask 027

Create a file:

touch file.txt

Verify:

ls -l file.txt

Real Production Examples¶

Secure deployment.

umask 027

SSH key generation.

umask 077

Application configuration.

umask 027

Shared development environment.

umask 002

CI/CD runner.

umask 022

Production Perspective¶

umask is commonly configured for:

Linux servers
Kubernetes worker nodes
Docker containers
Jenkins agents
GitLab Runners
Application deployments
Shared development environments
Security-hardened systems

A secure umask helps prevent accidental exposure of newly created files.

Hands-on Lab¶

Task 1¶

Display the current umask.

umask

Task 2¶

Display symbolic format.

umask -S

Task 3¶

Create a file.

touch file1

Inspect:

ls -l file1

Task 4¶

Set:

umask 027

Task 5¶

Create another file.

touch file2

Compare permissions.

Task 6¶

Create a directory.

mkdir project

Check:

ls -ld project

Task 7¶

Set:

umask 077

Create:

touch secret.txt

Inspect permissions.

Task 8¶

Restore your previous umask.

umask 022

(Or restore the value that was originally configured on your system.)

Command Deep Dive¶

Command	Purpose	Production Example
`umask`	Display current mask	Security audits
`umask -S`	Symbolic view	Learning & troubleshooting
`umask 027`	Restrict defaults	Production servers
`touch`	Create test files	Verification
`mkdir`	Create test directories	Permission testing

Production Troubleshooting Scenario¶

Scenario

A DevOps engineer discovers that newly created configuration files are world-readable.

Investigation:

umask

touch app.conf

ls -l app.conf

Output:

-rw-r--r--

The application stores sensitive credentials.

Solution:

umask 077

touch app.conf

New permissions:

-rw-------

Sensitive configuration files are now accessible only to the owner.

Best Practices¶

Use 022 for general-purpose Linux systems.
Use 027 for production application servers.
Use 077 for sensitive environments and secrets.
Verify file permissions after changing the umask.
Configure permanent umask values through appropriate shell initialization files when required.

Common Mistakes¶

❌ Thinking umask adds permissions.

✅ It removes permissions from the default values.

❌ Expecting umask to change existing files.

✅ umask affects only newly created files and directories.

❌ Setting 000 on production servers.

✅ This can make newly created files writable by everyone, creating a significant security risk.

Interview Questions¶

Beginner¶

What is umask?
What are the default permissions for new files?
What are the default permissions for new directories?
How do you display the current umask?

Intermediate¶

Calculate the resulting permissions for files and directories with umask 027.
Why are regular files created with a base permission of 666 instead of 777?
How do you configure a persistent umask for your user?
Does changing the umask affect existing files?

Architect Level¶

Which umask would you configure for a production application server, and why?
How does an incorrect umask create security risks?
How would you standardize umask settings across hundreds of Linux servers?

Summary¶

In this lesson, you learned:

What umask is
How default permissions are calculated
Viewing and modifying the umask
Temporary vs permanent configuration
Secure umask values
Production security practices

umask is one of Linux's most important preventive security mechanisms. By controlling the default permissions of newly created files and directories, it helps protect sensitive data and supports secure system administration.

Key Takeaways¶

umask removes permissions from default values.
Default file permissions start at 666.
Default directory permissions start at 777.
umask 022 results in 644 for files and 755 for directories.
umask 077 is recommended for sensitive files and private environments.
umask affects only newly created files and directories.

What's Next?¶

Access Control Lists (ACL) in Linux — Fine-Grained File Permissions

In the next lesson, you'll learn:

What ACLs are and why they exist
Viewing and modifying ACLs with getfacl and setfacl
Default and recursive ACLs
The ACL mask and the + indicator in ls -l
Production troubleshooting for shared access