What is umask in Linux?
UMASK in Linux or Unix systems is known as User Mask or it is also called as User file creation Mask. This is a base permission or default permission when a new file or folder is created in the Linux machine.
It is used by multiple commands in Linux like mkdir, touch, tee, and other commands which creates files and directories. It gets involved in each and every step when a new file or directory gets created.
File Permissions:
Before we move ahead to deep dive and understand umask, let’s first understand file permissions in short.
Linux is known for its security. Each file or directory in Linux has a specific set of permissions and ownerships. Let’s have a look at the user class below.
Each file in Linux will have below three user classes associated with it.
- User - A user who owns the file - By default, this indicates who created the file unless you change it.
- Group - This indicated the people in the group will have assigned permissions to the file.
- Other - This restricts the other users who are not the owner or in the assigned group.
There are three types of file access for each user class mentioned above.
- r - read permission - the ability to read the contents of the file
- w - write permission - the ability to change the contents of the file
- x - execute permission - the ability to execute the file as a program
The above concept tells you who is allowed to read the file content, modify the file content or execute the program.
Viewing Permissions - Symbolic Mode:
Let’s have a look at below file ownership. You can fetch the information on your Linux machine by typing ls -l command.
The first character in the above image shows the file type. There could be different types of files in Linux as below.
- |
Indicates the simple regular file with different extensions like .txt, .json, .sh, .py, .rb, and so on |
d |
Indicates directory/folder |
l |
Indicates a symbolic link or symlink or soft link |
c |
Indicates character device file |
b |
Indicates block device file |
The next nine symbols are divided into three parts as below.
rwx |
The file owner can read the content, modify the contents and execute the file as a program |
r-x |
Members in the group “users” can read the content and execute the file as a program but cannot modify the file contents |
r-x |
The one who is not the owner also not the member of the group i.e. other, can also read the contents of the file and execute the file as a program but cannot modify the file contents |
Viewing Permissions - Numeric Mode:
There is an additional way to represent permissions using numbers which are called Numeric Mode.
Let’s look at the Numeric file permission chart below.
0 |
--- |
No permission |
1 |
--x |
Only Execute permission |
2 |
-w- |
Only write permission |
3 |
-wx |
Write and Execute permission |
4 |
r-- |
Only read permission |
5 |
r-x |
Read and Execute permission |
6 |
rw- |
Read and Write permission |
7 |
rwx |
Read, Write and Execute permission |
If I refer this Numeric permission chart and apply it on the same directory mentioned in the above image, the permission will look like below.
rwx |
4+2+1 |
7 |
r-x |
4+0+1 |
5 |
r-x |
4+0+1 |
5 |
Hence, the numeric permission of the testdir directory is 755.
Understanding UMASK:
Let’s create a new file and new directory by executing the below command.
$ touch testfile
$ mkdir testdir
Let’s view the permissions of testfile and testdir by executing ls -l command.
$ ls -l
Output:
drwxr-xr-x 2 niteshb users 4096 Mar 21 22:43 testdir
-rw-r--r-- 1 niteshb users 0 Mar 21 22:43 testfile
Did you notice the permissions? They are different, right? This is because of the default umask value which is set in the Linux machine.
By default, on the Linux machine, the default creation permission for a file is 666 which gives read and write permission to the owner, group, and others and 777 for a directory which means read, write and execute permission to the owner, group and others.
As we know directories cannot be executable. Then why directory need an execute permission? Well, the execute permission to the directory is to allow accessing contents under the directory. If using chmod command we change the permission of directory to 666 and try going into the directory by cd command, you will get permission denied error.
On most of the Linux distributions, the default system-wide value is set in pam_umask.so or in /etc/profile file. By adding the value in ~/.bashrc file in the user’s home directory, we can make a umask value specific for the user.
To check umask value, execute umask command.
$umask
Output:
0022
We can ignore the very first 0 from above four numbers for now. It is a part of advanced permission in Linux. Which can prevent modifying file even if you have write permission or we can prevent to delete a file even if you are the root user. In this blog, we are only going to concentrate on the other three numbers.
To change the current session umask value, execute the below command followed by the desired value.
$umask 0044
How files and directories get their permissions:
The value associated with umask is NOT the permission you get for your files and directories.
There is a very simple calculation. As we mentioned above that the default value for a file is 666 and for a directory, it’s 777. To calculate permission bits for new files or directories, subtract the umask value from the default value.
For example, let’s calculate how a new file or directory permission will affect because of umask.
- Files: 666 - 022 = 644. According to the permission, the owner can read and execute the file. Groups and others can read the file.
- Directory: 777 - 022 = 755. This means the owner will have all read, write permission and cd to the directory. Group and others can read and list the contents of the directory and cd to the directory.
You can also view the umask value in numeric form by executing below command.
$umask
Output:
u=rwx,g=rx,o=rx
Unlike the numeric notation, the symbolic notation value contains the permission bits that will be set on the newly created files and directories.
Setting the mask value:
The file creation mask can be set using octal or symbolic notation. To make the changes permanent set the new umask value in a global configuration file like /etc/profile file which will affect all users or in a user’s shell configuration files such as ~/.profile, ~/.bashrc or ~/.zshrc which will affect only the user. The user files have precedence over the global files.
Before making changes to the umask
value make sure the new value doesn’t pose a potential security risk. Values less restrictive than 022
should be used with great caution. For example umask 000
means that anyone will have read, write, and execute permission for all newly created files.
Let’s say we want to set more restrictive permissions for the newly created files and directories so others will not be able to cd
to the directories and read files. The permissions we want are 750
for directories and 640
for files.
To calculate the umask
value simply subtract the desired permissions from the default one:
Umask value: 777-750 = 027
The desired umask
value represented in numeric notation is 027
.
To permanently set the new value system-wide open the /etc/profile
file with your text editor and change or add the following line at the beginning of the file:
umask 0027
For changes to take effect run the following source command or log out and log in:
$source /etc/profile
To verify the new settings we will create one new file and directory using the below commands.
$mkdir newtestdir
$touch newtestfile
If you check the permissions using the ls command you will notice that the new file has 640
and the new directory 750
permissions, as we wanted:
drwxr-xr-- 2 niteshb users 4096 Mar 21 22:43 newtestdir
-rw-r----- 1 niteshb users 0 Mar 21 22:43 newtestfile
Another way to set the file creation mask is by using the symbolic notation. For example umask u=rwx,g=rx,o=
is same as umask 027
.
Conclusion:
In this guide, we have explained the Linux permissions and how to use the umask
command to set the permissions bits for newly created files or directories.
For more information type below command in your terminal.
$man umask