Umask

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Umask" – news · newspapers · books · scholar · JSTOR (March 2017) (Learn how and when to remove this message)

umask is a shell command that reports or sets the mask value that limits the file permissions for newly created files in many Unix and Unix-like file systems. A system call with the same name, umask(), provides access to the mask value stored in the operating system (OS), and the command provides shell user access to the system call. Additionally, the mask value, formally file mode creation mask, is often referred to as the umask.

When a new file is created, its access permissions are restricted by the stored umask mask value. The file's permission bits that each grant access are cleared by corresponding bits of the mask that are set. Set bits of the mask disallow the permission and clear bits of the mask allow the permission. The otherwise default value of a file's permissions is defined elsewhere. The mask just prevents corresponding bits of the default. The mask acts as a last-stage filter that strips away permissions as a file is created; each bit that is set strips away its corresponding permission. Permissions may be changed later including via the chmod command.

The operating system maintains a umask mask value for each process that is accessible via the umask command and umask() system call. When a process spawns a new process, the child inherits the mask from its parent.^[1]

Generally, the mask only affects file permissions during the creation of new files; however, the chmod command checks the mask when the mode options are specified using symbolic mode and a reference to a class of users is not specified.

The umask command is used with Unix-like operating systems, and the umask() system call is defined in the POSIX.1 specification.

Before the umask capability (command, system call and stored value) was introduced to Unix, developers used various mechanisms to restrict access in order to prevent security breach. The umask capability was introduced around 1978, in the seventh edition of the operating system,^[2] to allow sites, groups and individuals to choose their own defaults. The capability has been implemented in most, if not all, contemporary Unix-like operating systems.

With no parameter, the umask command reports the stored mask either as octal or symbolic notation, depending on the implementation.^[3][4] In some shells, the -S option selects symbolic notation. For example:

$ umask
0022
$ umask -S
u=rwx,g=rx,o=rx

Invoked with an octal parameter, the command updates the stored mask to input value:

$ umask 007
$ umask
0007
$ umask -S
u=rwx,g=rwx,o=

As normal for a numeric representation, if fewer than 4 digits are entered, leading zeros are assumed. But the command fails if the input is more than 4 digits. This is notable since some languages (i.e. C) use a leading zero to denote octal format for a literal, but umask does support this notation.

The last three digits encode the user, group and others classes, respectively. If a fourth digit is present, the first digit addresses the three special attributes: setuid, setgid and sticky bit.

When umask is invoked with a parameter in symbolic notation, it modifies the stored mask so that a newly created file is allowed to have the permissions added and disallowed to have the permissions removed. The logic is backwards from the mask value. Adding a permission clears the associated bit of the mask so that the permission is allowed when a file is created. Removing a permission sets the associated bit so that the permission is disallowed when a file is created.

Changes to the mask in symbolic notation are expressed as [classes]+|-|=operations; with multiple expressions separated by comma and the last terminated by a space.

This syntax does not work in C shell due to the different behavior of its umask command.

Class is specified as u for user, g for group, o for others or a combination of these letters to select multiple. If not specified or a, then all classes are selected, same as ugo.

The operator specifies how the mask is modified. + allows the specified permissions without changing unspecified permissions. - disallows permissions without changing unspecified permissions. = allows the specified permissions and disallows the unspecified permissions of the class.

The following table describes the operations (and flags) than can be allowed or prohibited.

Assuming typical a mask value: u=rwx,g=rx,o=rx which allows all permissions except for write for group and others, the following example shows how a new file (created via touch lacks write for group and others.

$ touch foo
$ ls -l foo
-rwxr-xr-x  1 me  developer  6010 Jul 10 17:10 foo

The following example disallows write permission for the user class, then creates a file that has no write permission for the user class:

$ umask u-w
$ umask -S
u=rx,g=rx,o=rx
$ touch bar
$ ls -l bar
-r--r--r--  1 me  developer  6010 Jul 10 17:15 bar

The following table indicates how a digit of the umask mask affects the permissions of a new file if the default permissions include all operations (rwx). The mask value is applied by first negating (complementing) the mask, and then performing a logical AND with the default file mode.^[5]

Many operating systems do not allow a file to be created with execute permissions and therefore newly created files have no execute permission regardless of the umask mask.

In general, the umask mask is only used when creating a file. However, for some implementations of the chmod command, when using symbolic notation and no user is specified, the mask is applied to the requested permissions before they are applied to the file. For example:

$ umask 0000
$ chmod +rwx filename
$ ls -l filename
-rwxrwxrwx filename
$ umask 0022
$ chmod +rwx filename
$ ls -l filename
-rwxr-xr-x filename

In the Linux kernel, the fat, hfs, hpfs, ntfs, and udf file system drivers support a umask mount option, which controls how the disk information is mapped to permissions. This is not the same as the per-process mask described above, although the permissions are calculated in a similar way. Some of these file system drivers also support separate masks for files and directories, using mount options such as fmask.

The Wikibook Guide to Unix has a page on the topic of: Commands