The umask acts as a set of permissions that applications cannot set on files. It's a file mode creation mask for processes and cannot be set for directories itself. Most applications would not create files with execute permissions set, so they would have a default of 666
, which is then modified by the umask.
As you have set the umask to remove the read/write bits for the owner and the read bits for others, a default such as 777
in applications would result in the file permissions being 133
. This would mean that you (and others) could execute the file, and others would be able to write to it.
If you want to make files not be read/write/execute by anyone but the owner, you should use a umask like 077
to turn off those permissions for the group & others.
In contrast, a umask of 000
will make newly created directories readable, writable and descendible for everyone (the permissions will be 777
). Such a umask is highly insecure and you should never set the umask to 000
.
The default umask on Ubuntu was 022
which means that newly created files are readable by everyone, but only writable by the owner:
user@computer:~$ touch new-file-name
user@computer:~$ ls -dl new-file-name
-rw-r--r-- 1 user user 0 Apr 1 19:15 new-file-name
Starting in Ubuntu Oneiric (11.10) the default umask was relaxed to 002
, which expands write-access to the owner's group:
user@computer:~$ touch new-file-name
user@computer:~$ ls -dl new-file-name
-rw-rw-r-- 1 user user 0 Apr 1 19:15 new-file-name
Viewing and modifying umask
To view your current umask setting, open a terminal and run the command:
umask
To change the umask setting of the current shell to something else, say 077, run:
umask 077
To test whether this setting works or not, you can create a new file (file permissions of an existing file won't be affected) and show information about the file, run:
user@computer:~$ touch new-file-name
user@computer:~$ ls -dl new-file-name
-rw------- 1 user user 0 Apr 1 19:14 new-file-name
The umask setting is inherited by processes started from the same shell. For example, start the text editor GEdit by executing gedit
in the terminal and save a file using gedit. You'll notice that the newly created file is affected by the same umask setting as in the terminal.
Use case: multi-user system
If you are on a system that's shared by multiple users, it's desired that others cannot read files in your home directory. For that, a umask is very useful. Edit ~/.profile
and add a new line with:
umask 007
You need to re-login for this umask change in ~/.profile
to take effect. Next, you need to change existing file permissions of files in your home directory by removing the read, write and execute bit for the world. Open a terminal and execute:
chmod -R o-rwx ~
If you want this umask setting be applied to all users on the system, you could edit the system-wide profile file at /etc/profile
.
Best Answer
The 027 umask setting means that the owning group would be allowed to read the newly-created files as well. This moves the permission granting model a little further from dealing with permission bits and bases it on group ownership.
This will create directories with permission 750.
Please check this great article 027 umask — a compromise between security and simplicity.