Demystifying Linux umask: Calculating Default Permissions and System Hardening
In Linux, newly created files and directories do not specify arbitrary permissions. Instead, the process creating the object requests a base permission set, which the kernel filters through the process’s umask (User Mask). Understanding how umask operates is essential for preventing accidental disclosure of confidential files (e.g., world-readable configuration files or SSH keys). The Fundamental Rule: Masking, Not Subtraction By default, the Linux operating system assigns base permissions: Default Base for Files: 0666 (rw-rw-rw-) — Files are never created with execute (x) permissions by default for safety. Default Base for Directories: 0777 (rwxrwxrwx) — Directories require execute permissions to allow traversal (cd). The umask acts as a bitmask filter: it specifies which permission bits should be disabled (masked out) when a new file or directory is created. ...