Filesystems · intermediate
umask
A process's file mode creation mask, or umask, clears selected permission bits from the mode requested when a new filesystem object is created. It supplies a default restriction, not the final mode for every creation.
Why it matters
umask controls whether newly created files and directories begin private, group-shareable, or world-readable. Service launchers, shells, and deployment tools can inherit a mask that silently changes results.
Mental model
How to reason about umask
Without a governing default ACL, traditional creation computes requested_mode AND NOT umask. A default ACL can instead derive and further constrain the inherited permissions according to the platform's ACL rules. Programs commonly request 0666 for regular files and 0777 for directories, which is why ordinary files do not gain execute bits merely from a permissive mask.
Analogy
umask is a stencil laid over a creator's requested permission pattern: covered holes are removed, but the stencil cannot add a hole the creator never requested.
Examples
See the boundary, not just the happy path
Worked example · Common shared-readable defaults
umask 022; touch note; mkdir workspaceWith typical requests, note becomes 0644 and workspace becomes 0755 because group/other write bits are cleared. The exact result can also be affected by default ACLs and program choices.
Worked example · Private defaults
umask 077; touch token; mkdir privateA typical touch request yields 0600 and mkdir yields 0700, withholding all group and other bits at creation time.
Useful contrast · chmod changes an existing mode
chmod 640 tokenchmod sets or modifies permission bits on an existing object. Changing umask now would affect later creations, not retroactively rewrite token.
Common mistakes
Misconceptions to remove early
Treating umask as the desired final permission
The mask removes bits from the creator's requested mode. umask 022 does not mean mode 022, and a program requesting fewer permissions keeps those additional restrictions.
Using ordinary decimal subtraction as the general rule
The operation is bit clearing: requested & ~mask. Subtraction happens to resemble common cases but fails when requested and masked bits do not line up that way.
Quick check
Can you predict the result?
1. With requested mode 0666 and umask 027, what traditional mode remains?
- • 0640
- • 0750
- • 0627
2. Why does umask 000 usually not make a newly created regular file executable?
Keep building