umaskSet default permissions for new files
umask is the set of permission bits that are switched OFF on every new file and directory a process creates. With umask 022 new files are 644 and directories 755; with 077 they're private. It's a per-process setting, inherited by children, which is why services can have a different one from your shell.
umask [-S] [MODE]You want to understand why your new files come out as 664 and root's as 644.
umaskA shell builtin: it must change the shell process itself, so it can't be a separate program.
Every process has a umask in its kernel task structure (visible as Umask: in /proc/PID/status). It's set with the umask() system call and inherited across fork and exec. When a program creates a file it passes a requested mode, usually 0666 for files and 0777 for directories, and the kernel stores mode & ~umask. It's a bit mask, not a subtraction: umask 033 gives 644 files (not 633). Executables get x only because compilers and cp request it. On Ubuntu the login umask comes from pam_umask, which reads UMASK 022 from /etc/login.defs and, with USERGROUPS_ENAB yes, makes it 002 for users whose private group has their name, so your files are group-writable but only your own group is in it. Root stays at 022. systemd services don't use your shell's umask: they get UMask= from the unit (default 0022). If a directory has a default ACL, that replaces the umask for files created in it.
(no argument)Print the current umask in octal, e.g. 0022-SPrint it symbolically: what is ALLOWED (u=rwx,g=rx,o=rx)022Files 644, dirs 755: classic server default002Files 664, dirs 775: user-private-group setups, shared dirs027Files 640, dirs 750: group may read, others nothing077Files 600, dirs 700: private (secrets, root scripts)u=rwx,g=rx,o=Symbolic form, same as 027UMask=0027systemd unit setting for a service's umaskComputing new modes by subtraction (666 - 033 = 633)umask is applied bit by bit: mode & ~umask. A bit that wasn't requested can't be removed twice.
Think 'which rwx bits does the mask clear?': 033 clears wx for group and othersPutting umask 027 in ~/.bashrc to protect files written by a serviceServices started by systemd never read your shell files; they use UMask= (default 0022).
Set UMask=0027 in the unit or a drop-in, then restartRunning /usr/bin/umask or sudo umask 077umask must change the current process. A separate process or a sudo'd one changes only itself and then exits.
Use the shell builtin: umask 077 in the shell or script itselfExpecting umask to make new files executable or more openumask only removes bits from what the program requested (666 for files).
chmod after creation, or a default ACL for shared dirsTry these on a Linux machine of your own. Each task has a hint and a solution.
Print your umask in octal and symbolic form.
In a subshell, set umask 077 and create ~/data/private.txt. Check its mode is 600.
Predict, then check, the mode of a directory created with umask 027.
Find the umask of your current shell from /proc.
umaskSet default permissions for new files
umask is the set of permission bits that are switched OFF on every new file and directory a process creates. With umask 022 new files are 644 and directories 755; with 077 they're private. It's a per-process setting, inherited by children, which is why services can have a different one from your shell.
umask [-S] [MODE]You want to understand why your new files come out as 664 and root's as 644.
umaskA shell builtin: it must change the shell process itself, so it can't be a separate program.
Every process has a umask in its kernel task structure (visible as Umask: in /proc/PID/status). It's set with the umask() system call and inherited across fork and exec. When a program creates a file it passes a requested mode, usually 0666 for files and 0777 for directories, and the kernel stores mode & ~umask. It's a bit mask, not a subtraction: umask 033 gives 644 files (not 633). Executables get x only because compilers and cp request it. On Ubuntu the login umask comes from pam_umask, which reads UMASK 022 from /etc/login.defs and, with USERGROUPS_ENAB yes, makes it 002 for users whose private group has their name, so your files are group-writable but only your own group is in it. Root stays at 022. systemd services don't use your shell's umask: they get UMask= from the unit (default 0022). If a directory has a default ACL, that replaces the umask for files created in it.
(no argument)Print the current umask in octal, e.g. 0022-SPrint it symbolically: what is ALLOWED (u=rwx,g=rx,o=rx)022Files 644, dirs 755: classic server default002Files 664, dirs 775: user-private-group setups, shared dirs027Files 640, dirs 750: group may read, others nothing077Files 600, dirs 700: private (secrets, root scripts)u=rwx,g=rx,o=Symbolic form, same as 027UMask=0027systemd unit setting for a service's umaskComputing new modes by subtraction (666 - 033 = 633)umask is applied bit by bit: mode & ~umask. A bit that wasn't requested can't be removed twice.
Think 'which rwx bits does the mask clear?': 033 clears wx for group and othersPutting umask 027 in ~/.bashrc to protect files written by a serviceServices started by systemd never read your shell files; they use UMask= (default 0022).
Set UMask=0027 in the unit or a drop-in, then restartRunning /usr/bin/umask or sudo umask 077umask must change the current process. A separate process or a sudo'd one changes only itself and then exits.
Use the shell builtin: umask 077 in the shell or script itselfExpecting umask to make new files executable or more openumask only removes bits from what the program requested (666 for files).
chmod after creation, or a default ACL for shared dirsTry these on a Linux machine of your own. Each task has a hint and a solution.
Print your umask in octal and symbolic form.
In a subshell, set umask 077 and create ~/data/private.txt. Check its mode is 600.
Predict, then check, the mode of a directory created with umask 027.
Find the umask of your current shell from /proc.