What is umask in Linux?

UMASK in Linux or Unix systems is known as User Mask or it is also called as User file creation Mask. This is a base permission or default permission when a new file or folder is created in the Linux machine. 

It is used by multiple commands in Linux like mkdir, touch, tee, and other commands which creates files and directories. It gets involved in each and every step when a new file or directory gets created. 

File Permissions:

Before we move ahead to deep dive and understand umask, let’s first understand file permissions in short. 

Linux is known for its security. Each file or directory in Linux has a specific set of permissions and ownerships. Let’s have a look at the user class below. 

Each file in Linux will have below three user classes associated with it. 

1. User – A user who owns the file – By default, this indicates who created the file unless you change it.
2. Group – This indicated the people in the group will have assigned permissions to the file.
3. Other – This restricts the other users who are not the owner or in the assigned group.

There are three types of file access for each user class mentioned above.

1. r – read permission – the ability to read the contents of the file
2. w – write permission – the ability to change the contents of the file
3. x – execute permission – the ability to execute the file as a program

The above concept tells you who is allowed to read the file content, modify the file content or execute the program. 

Viewing Permissions – Symbolic Mode:

Let’s have a look at below file ownership. You can fetch the information on your Linux machine by typing ls -l command.

<img alt="Linux Umask explained" data-ezsrc="https://kirelos.com/wp-content/uploads/2020/03/echo/file_permission_image2.png5e82319d700fd.jpg" ezimgfmt="rs rscb1 src ng ngcb1" height="275" src="data:image/svg xml,” width=”750″>

The first character in the above image shows the file type. There could be different types of files in Linux as below.

The next nine symbols are divided into three parts as below. 

Viewing Permissions – Numeric Mode:

There is an additional way to represent permissions using numbers which are called Numeric Mode.

Let’s look at the Numeric file permission chart below.

If I refer this Numeric permission chart and apply it on the same directory mentioned in the above image, the permission will look like below.

Hence, the numeric permission of the testdir directory is 755. 

Understanding UMASK:

Let’s create a new file and new directory by executing the below command.

$ touch testfile

$ mkdir testdir

Let’s view the permissions of testfile and testdir by executing ls -l command.

$ ls -l

Output:

drwxr-xr-x  2 niteshb users    4096 Mar 21 22:43 testdir

-rw-r--r--  1 niteshb users       0 Mar 21 22:43 testfile

Did you notice the permissions? They are different, right? This is because of the default umask value which is set in the Linux machine. 

By default, on the Linux machine, the default creation permission for a file is 666 which gives read and write permission to the owner, group, and others and 777 for a directory which means read, write and execute permission to the owner, group and others. 

As we know directories cannot be executable. Then why directory need an execute permission? Well, the execute permission to the directory is to allow accessing contents under the directory. If using chmod command we change the permission of directory to 666 and try going into the directory by cd command, you will get permission denied error. 

On most of the Linux distributions, the default system-wide value is set in pam_umask.so or in /etc/profile file. By adding the value in ~/.bashrc file in the user’s home directory, we can make a umask value specific for the user. 

To check umask value, execute umask command.

$umask

Output:

0022

We can ignore the very first 0 from above four numbers for now. It is a part of advanced permission in Linux. Which can prevent modifying file even if you have write permission or we can prevent to delete a file even if you are the root user. In this blog, we are only going to concentrate on the other three numbers. Advertisements

To change the current session umask value, execute the below command followed by the desired value. 

$umask 0044

How files and directories get their permissions:

The value associated with umask is NOT the permission you get for your files and directories. 

There is a very simple calculation. As we mentioned above that the default value for a file is 666 and for a directory, it’s 777. To calculate permission bits for new files or directories, subtract the umask value from the default value. 

For example, let’s calculate how a new file or directory permission will affect because of umask.

• Files: 666 – 022 = 644. According to the permission, the owner can read and execute the file. Groups and others can read the file. 
• Directory: 777 – 022 = 755. This means the owner will have all read, write permission and cd to the directory. Group and others can read and list the contents of the directory and cd to the directory. 

You can also view the umask value in numeric form by executing below command.

$umask

Output:

u=rwx,g=rx,o=rx

Unlike the numeric notation, the symbolic notation value contains the permission bits that will be set on the newly created files and directories.

Setting the mask value:

The file creation mask can be set using octal or symbolic notation. To make the changes permanent set the new umask value in a global configuration file like /etc/profile file which will affect all users or in a user’s shell configuration files such as ~/.profile, ~/.bashrc or ~/.zshrc which will affect only the user. The user files have precedence over the global files.

Before making changes to the umask value make sure the new value doesn’t pose a potential security risk. Values less restrictive than 022 should be used with great caution. For example umask 000 means that anyone will have read, write, and execute permission for all newly created files.

Let’s say we want to set more restrictive permissions for the newly created files and directories so others will not be able to cd to the directories and read files. The permissions we want are 750 for directories and 640 for files.Advertisements

To calculate the umask value simply subtract the desired permissions from the default one:

Umask value: 777-750 = 027

The desired umask value represented in numeric notation is 027.

To permanently set the new value system-wide open the /etc/profile file with your text editor and change or add the following line at the beginning of the file:

umask 0027

For changes to take effect run the following source command or log out and log in:

$source /etc/profile

To verify the new settings we will create one new file and directory using the below commands.

$mkdir newtestdir

$touch newtestfile

If you check the permissions using the ls command you will notice that the new file has 640 and the new directory 750 permissions, as we wanted:

drwxr-xr--  2 niteshb  users    4096 Mar 21 22:43 newtestdir

-rw-r-----  1 niteshb  users       0 Mar 21 22:43 newtestfile

Another way to set the file creation mask is by using the symbolic notation. For example umask u=rwx,g=rx,o= is same as umask 027.

Conclusion:

In this guide, we have explained the Linux permissions and how to use the umask command to set the permissions bits for newly created files or directories.

For more information type below command in your terminal.

$man umask