umask and default permissions

Where do 644 and 755 come from?

Programs that create files ask the kernel for a generous mode: 666 for a plain file (everyone may read and write), 777 for a directory. The kernel then removes whatever bits are set in the process's umask before creating the entry. The default umask is 022: remove write from group and others. 666 minus 022 gives 644; 777 minus 022 gives 755. That single number is why every file you have touched in this course came out -rw-r--r-- and every mkdir gave drwxr-xr-x.

"Minus" is a convenient lie: it is really a bitwise *clear*, so the mask can only take permissions away, never add them. That is why a new file never comes out executable whatever the umask: the request was 666, with no x to begin with. Programs must chmod +x explicitly, and compilers do.

Reading and setting it

~% umask
0022
~% umask -S
u=rwx,g=rx,o=rx
~% umask 077
~% touch private.txt; mkdir private.d
~% ls -ld private.*
drwx------    2 root     root             0 Oct  4 19:25 private.d
-rw-------    1 root     root             0 Oct  4 19:25 private.txt
~% umask 022

umask is a shell builtin, not a program, because the mask is a property of each process and children inherit it. Called alone it prints the current value with a leading zero; -S shows the same thing as the permissions that *survive*, which many people find easier to read. Called with a number it sets the mask for this shell and every command you start from it afterwards. It does not touch existing files.

Just for one command

Because the mask is inherited downwards but never upwards, a subshell is the clean way to apply it once: (umask 077; touch secret.txt) creates the file with mode 600 and leaves your interactive shell's umask untouched when the parentheses close. The same trick works for cd and for variables. To make a umask permanent you put the umask line in a startup file such as /etc/profile, which lesson 70 covers.