In Linux, newly created files and directories do not specify arbitrary permissions. Instead, the process creating the object requests a base permission set, which the kernel filters through the process’s umask (User Mask).

Understanding how umask operates is essential for preventing accidental disclosure of confidential files (e.g., world-readable configuration files or SSH keys).

The Fundamental Rule: Masking, Not Subtraction

By default, the Linux operating system assigns base permissions:

  • Default Base for Files: 0666 (rw-rw-rw-) — Files are never created with execute (x) permissions by default for safety.
  • Default Base for Directories: 0777 (rwxrwxrwx) — Directories require execute permissions to allow traversal (cd).

The umask acts as a bitmask filter: it specifies which permission bits should be disabled (masked out) when a new file or directory is created.

$$\text{Effective Permission} = \text{Base Permission} \ & \ (\sim\text{umask})$$

Common umask Values and Resulting Permissions

umask File Creation Permission Directory Creation Permission Security Profile
0022 644 (rw-r--r--) 755 (rwxr-xr-x) Standard default on Red Hat / CentOS for shared systems. Other users can read.
0002 664 (rw-rw-r--) 775 (rwxrwxr-x) Common for User Private Groups (UPG) where group members share write access.
0027 640 (rw-r-----) 750 (rwxr-x---) Hardened Server Default: Group can read; others have zero access.
0077 600 (rw-------) 700 (rwx------) Maximum Privacy: Only the creating user can read or write.

Configuration Locations

The system-wide umask is configured across global shell profiles:

  1. /etc/profile and /etc/profile.d/*.sh (login shells)
  2. /etc/bashrc or /etc/bash.bashrc (non-login interactive shells)
  3. /etc/login.defs (controls default umask applied during account creation via UMASK)

Standard Conditional Logic in /etc/bashrc:

if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
    # User has their own private primary group
    umask 002
else
    # Root or system account
    umask 022
fi

Modifying and Auditing umask

View active umask:

umask
# 0022

# Display symbolic representation:
umask -S
# u=rwx,g=rx,o=rx

Change umask dynamically for the current session:

umask 0027
touch secure_file.txt
ls -l secure_file.txt
# -rw-r----- 1 operator operator 0 Jul 10 06:04 secure_file.txt

All subsequent files created in this shell session will strictly prohibit access by unprivileged other users.