What it does
Programs create new files with 666 (rw for all) and new directories with 777. The umask removes bits from this: with umask 022, files get 644 and directories 755.
umask is a shell built-in: it changes only the current shell and its children. Make it permanent in ~/.bashrc (one user) or a file in /etc/profile.d/ (all users). Services use the UMask= setting in their systemd unit.
How to write it
umask [-p] [-S] [MODE]Options 3
Most used
Nothing matches this filter.
Examples 11
$ run as a normal user# run as root (or with sudo)
1Show the mask
umask 0022The RHEL default.
2Show it in letters
umask -S u=rwx,g=rx,o=rxThe rights that new directories get.
3Set a safer mask for this shell
umask 027 touch f; mkdir d; ls -ld f d -rw-r-----. 1 student student 0 Oct 25 10:30 f drwxr-x---. 2 student student 6 Oct 25 10:30 dOthers get nothing.
4Make it permanent for one user
echo "umask 027" >> ~/.bashrcValid from the next shell.
5Make it permanent for all users
echo "umask 027" > /etc/profile.d/umask.shRead at every login shell.
6Very private files
umask 077Files 600, folders 700.
7Set the umask with letters
umask u=rwx,g=rx,o= umask 0027Same as 027.
8Use a mask for one command only
(umask 077; openssl genrsa -out private.key 4096)The key file is private from the start (no time window).
9Set the umask of a service
systemctl edit myappAdd
[Service]andUMask=0027— shell files do not affect services.10Check the default of new users
grep -E '^(UMASK|HOME_MODE)' /etc/login.defs UMASK 022 HOME_MODE 0700login.defs sets the umask for login and the mode of new home folders.
11Why a file never gets x from the umask
Files start at 666; add x with chmod.
Nothing matches this filter.
Watch out
- The umask is not a chmod: it only affects files created later.
- A default ACL on a directory replaces the umask for new files in it.
Files
~/.bashrc- umask for one user.
/etc/profile.d/*.sh- umask for all login shells.
/etc/login.defs- UMASK and HOME_MODE.