How umask works
When a program creates a file it asks for a mode, almost always 666 (rw-rw-rw-) for files and 777 for directories. The kernel then clears every bit that is set in the process's umask. With the usual 022, the write bits for group and others are removed: files become 644, directories 755. With 077 everything for group and others goes: 600 and 700. The mask can only remove permissions, never add; a file never gets execute from the umask, because 666 never had it.
The arithmetic is mode & ~umask, a bitwise AND with the inverted mask, not subtraction, so umask 027 on 666 gives 640, not 639.
Common values
| umask | Files | Directories | Used for |
|---|---|---|---|
| 022 | 644 | 755 | Default on most distributions; others can read. |
| 002 | 664 | 775 | Debian/Ubuntu for users with a private group; group members can write. |
| 077 | 600 | 700 | Private by default: servers, home directories with secrets. |
| 027 | 640 | 750 | Group can read, others nothing; common hardening baseline (CIS). |
Where it is set
- Shell:
umaskprints it,umask 027sets it for the session; put it in~/.profileor/etc/profile.umask -Sshows it symbolically. - Login:
/etc/login.defs(UMASK) andpam_umaskset the value before the shell starts;/etc/profileon Debian derives it from whether the user has a private group. - systemd services:
UMask=0077in the[Service]section; services do not read shell profiles. - cron: jobs run with
022regardless of the user's shell settings; set it inside the script. - Docker: the container's default is
022; change it in the entrypoint or withumaskin the command.
Questions
Why do my new files have 644 when I want 664?
Your umask is 022. Set umask 002 (and make sure the directory’s group is the one you want, with the setgid bit on the directory so new files inherit it).
Does umask affect chmod?
No. chmod sets exact bits. umask only applies when a file is created without an explicit mode, which is nearly always.
Why does the directory get execute but the file does not?
Directories are created with 777 before the mask, files with 666. Execute on a directory means “can enter it”; files need chmod +x explicitly.
Is a four-digit umask different?
A leading 0 (0022) is just octal notation. The first digit would mask setuid/setgid/sticky, which creating processes never request, so it has no effect in practice.