What is umask in Linux?

HowToForge ^ | 01 April 2020 | Staff

[ShadowAce]

UMASK in Linux or Unix systems is known as User Mask or it is also called as User file creation Mask. This is a base permission or default permission when a new file or folder is created in the Linux machine. 

It is used by multiple commands in Linux like mkdir, touch, tee, and other commands which creates files and directories. It gets involved in each and every step when a new file or directory gets created. 

File Permissions:

Before we move ahead to deep dive and understand umask, let’s first understand file permissions in short. 

Linux is known for its security. Each file or directory in Linux has a specific set of permissions and ownerships. Let’s have a look at the user class below. 

Each file in Linux will have below three user classes associated with it. 

1. User - A user who owns the file - By default, this indicates who created the file unless you change it.
2. Group - This indicated the people in the group will have assigned permissions to the file.
3. Other - This restricts the other users who are not the owner or in the assigned group.

There are three types of file access for each user class mentioned above.

1. r - read permission - the ability to read the contents of the file
2. w - write permission - the ability to change the contents of the file
3. x - execute permission - the ability to execute the file as a program

The above concept tells you who is allowed to read the file content, modify the file content or execute the program. 

Viewing Permissions - Symbolic Mode:

Let’s have a look at below file ownership. You can fetch the information on your Linux machine by typing ls -l command.

The first character in the above image shows the file type. There could be different types of files in Linux as below.

-	Indicates the simple regular file with different extensions like .txt, .json, .sh, .py, .rb, and so on
d	Indicates directory/folder
l	Indicates a symbolic link or symlink or soft link
c	Indicates character device file
b	Indicates block device file

The next nine symbols are divided into three parts as below. 

rwx	The file owner can read the content, modify the contents and execute the file as a program
r-x	Members in the group “users” can read the content and execute the file as a program but cannot modify the file contents
r-x	The one who is not the owner also not the member of the group i.e. other, can also read the contents of the file and execute the file as a program but cannot modify the file contents

Viewing Permissions - Numeric Mode:

There is an additional way to represent permissions using numbers which are called Numeric Mode.

Let’s look at the Numeric file permission chart below.

0	---	No permission
1	--x	Only Execute permission
2	-w-	Only write permission
3	-wx	Write and Execute permission
4	r--	Only read permission
5	r-x	Read and Execute permission
6	rw-	Read and Write permission
7	rwx	Read, Write and Execute permission

If I refer this Numeric permission chart and apply it on the same directory mentioned in the above image, the permission will look like below.

rwx	4+2+1	7
r-x	4+0+1	5
r-x	4+0+1	5

Hence, the numeric permission of the testdir directory is 755. 

Understanding UMASK:

Let’s create a new file and new directory by executing the below command.

$ touch testfile

$ mkdir testdir

Let’s view the permissions of testfile and testdir by executing ls -l command.

$ ls -l

Output:

drwxr-xr-x  2 niteshb users    4096 Mar 21 22:43 testdir

-rw-r--r--  1 niteshb users       0 Mar 21 22:43 testfile

Did you notice the permissions? They are different, right? This is because of the default umask value which is set in the Linux machine. 

By default, on the Linux machine, the default creation permission for a file is 666 which gives read and write permission to the owner, group, and others and 777 for a directory which means read, write and execute permission to the owner, group and others. 

As we know directories cannot be executable. Then why directory need an execute permission? Well, the execute permission to the directory is to allow accessing contents under the directory. If using chmod command we change the permission of directory to 666 and try going into the directory by cd command, you will get permission denied error. 

On most of the Linux distributions, the default system-wide value is set in pam_umask.so or in /etc/profile file. By adding the value in ~/.bashrc file in the user’s home directory, we can make a umask value specific for the user. 

To check umask value, execute umask command.

$umask

Output:

0022

We can ignore the very first 0 from above four numbers for now. It is a part of advanced permission in Linux. Which can prevent modifying file even if you have write permission or we can prevent to delete a file even if you are the root user. In this blog, we are only going to concentrate on the other three numbers. 

To change the current session umask value, execute the below command followed by the desired value. 

$umask 0044

How files and directories get their permissions:

The value associated with umask is NOT the permission you get for your files and directories. 

There is a very simple calculation. As we mentioned above that the default value for a file is 666 and for a directory, it’s 777. To calculate permission bits for new files or directories, subtract the umask value from the default value. 

For example, let’s calculate how a new file or directory permission will affect because of umask.

• Files: 666 - 022 = 644. According to the permission, the owner can read and execute the file. Groups and others can read the file. 
• Directory: 777 - 022 = 755. This means the owner will have all read, write permission and cd to the directory. Group and others can read and list the contents of the directory and cd to the directory. 

You can also view the umask value in numeric form by executing below command.

$umask

Output:

u=rwx,g=rx,o=rx

Unlike the numeric notation, the symbolic notation value contains the permission bits that will be set on the newly created files and directories.

Setting the mask value:

The file creation mask can be set using octal or symbolic notation. To make the changes permanent set the new umask value in a global configuration file like /etc/profile file which will affect all users or in a user’s shell configuration files such as ~/.profile, ~/.bashrc or ~/.zshrc which will affect only the user. The user files have precedence over the global files.

Before making changes to the umask value make sure the new value doesn’t pose a potential security risk. Values less restrictive than 022 should be used with great caution. For example umask 000 means that anyone will have read, write, and execute permission for all newly created files.

Let’s say we want to set more restrictive permissions for the newly created files and directories so others will not be able to cd to the directories and read files. The permissions we want are 750 for directories and 640 for files.

To calculate the umask value simply subtract the desired permissions from the default one:

Umask value: 777-750 = 027

The desired umask value represented in numeric notation is 027.

To permanently set the new value system-wide open the /etc/profile file with your text editor and change or add the following line at the beginning of the file:

umask 0027

For changes to take effect run the following source command or log out and log in:

$source /etc/profile

To verify the new settings we will create one new file and directory using the below commands.

$mkdir newtestdir

$touch newtestfile

If you check the permissions using the ls command you will notice that the new file has 640 and the new directory 750 permissions, as we wanted:

drwxr-xr--  2 niteshb  users    4096 Mar 21 22:43 newtestdir

-rw-r-----  1 niteshb  users       0 Mar 21 22:43 newtestfile

Another way to set the file creation mask is by using the symbolic notation. For example umask u=rwx,g=rx,o= is same as umask 027.

Conclusion:

In this guide, we have explained the Linux permissions and how to use the umask command to set the permissions bits for newly created files or directories.

For more information type below command in your terminal.

$man umask

[ShadowAce]

Tech Ping

[central_va]

$su - root
#cd /
#rm -rf *

This corrects everything.

[ShadowAce]

I figured a non-virus thread may be good for people.....

[Red Badger]

UMASK is the Chinese Command to put you MASK BACK ON!...............

[Scrambler Bob]

#rm -rf *

This corrects everything.

If you first declare * = Pelosi

[PastorBooks]

“rm -rf *”

I see what you did there...

(Lest someone new to Linux reads this and tries it, that command will wipe your entire drive.)

[zadox]

Thanks, it was nice to have an otcv -other than corona virus- post. I’ve always just created the file then used chmod to change it to whatever I need.

[PastorBooks]

“UMASK is the Chinese Command to put you MASK BACK ON!...............”

:-)

And ‘cd ~’ means STAY HOME.

[Red Badger]

And ‘cd ~’ means STAY HOME.

CD ~ CHANGE DIRECTION!..................

[ken in texas]

Years ago someone in my group did that on one of the machines in our test lab. Fortunately, he worked in another city and was spared physical punishment.

[Campion]

Let’s just say, after you do that, you won’t be wasting any more time browsing FR.

[central_va]

I remember when making daily backups was done to protect against stupidity and not as a defense against nefarious destruction caused by virus attacks or break ins.

[Bob434]

ok don’t know how to ping everyone at once- but here3’s a totally off topic question, Just a quick response is fine if anyone knows how to do this- i hope you won’t mind?- it’s firefox related-

When I’ve got several tab open- sometimes I’ll accidentally click/drag on a tab and yank it off the main page so that it’s now in a separate window- a ‘new window’- This is totally annoying- (I have a mouse gesture program that allows me to quickly switch tabs by a mouse gesture- saves a ton of time- but now that the tab is now in it’s own window- i can’t do that)

is there a way to get it back onto the nest of tabs on main window?

[Bob434]

[[$su - root
#cd /
#rm -rf *]]

I did that and now the police are outside the door- what did you do to me?

[ShadowAce]

Yes, there is.

WARNING--It's so simple you'll hate yourself...

Drag the new window back onto the tab bar of the original window.

[ken in texas]

Yup. Fortunately, the machines were all in a test lab for my group, no production stuff, but a couple folks had work interrupted.

[Bob434]

i tried that- Not working for some reason- i’ll keep trying

[Bob434]

uggh- now it’s working- didn’t work before- Thanks for the suggestion- it’s just one of those little irritating things that drive a person nuts- and i didn’t know how to fix it- Thanks for the solution- i don’t know why it wasn’t working before- I think what i was doing (it was awhile ago) was trying to grab the minimized window onto the open main window (that doesn’t work- just tried it again)- gotta grab open new window tab and drag to open main window-

Thanks again-

[zeugma]

The permissions discussed in the article above aren't the only attributes you can set on a file/directory. There are also extended attributes that give you a little finer-grained control over files. You can even create a file that is immutable even by the root user.

In the following, lines that begin with "$" are the commands entered. Lines beginning with "###" are my comments.

$ id
uid=1000(zeugma) gid=1000(zeugma) groups=1000(zeugma),...
### The username is zeugma, as is the group name
$ touch myfile
### I created 'myfile'
$ ls -l 
total 0
-rw-rw-r-- 1 zeugma zeugma 0 Apr  1 11:36 myfile
### Yup, 'myfile' was created
$ rm myfile 
### I can delete it
$ touch myfile
### Create myfile again
$ ls -l
total 0
-rw-rw-r-- 1 zeugma zeugma 0 Apr  1 11:37 myfile
### Yup. the file was created
$ lsattr myfile 
-------------e-- myfile
### lsattr shows additional file attributes
$ chattr +i myfile
chattr: Operation not permitted while setting flags on myfile
### Ooops. Can't do that as a regular user
$ sudo chattr +i myfile
[sudo] password for amp: 
### Looks like the SuperUser can do it. Adding "i" to a file makes it read-only.
$ lsattr myfile 
----i--------e-- myfile
### now we see the 'i" in it's attributes
$ ls -l 
total 0
-rw-rw-r-- 1 zeugma zeugma 0 Apr  1 11:36 myfile
### looks the same with an 'ls' command though...
$ rm myfile
rm: cannot remove 'myfile': Operation not permitted
### looks like I can't delete it, even though I own it, and the file is "rw"
$ sudo rm myfile
rm: cannot remove 'myfile': Operation not permitted
### Not even SuperUser can remove it!
$ sudo chattr -i myfile 
### Removing the readonly bit
$ rm myfile
### I can now delete the file
$ ls -l
total 0
### Yup it's gone.