umask

umask

Original author(s)	AT&T Bell Laboratories
Developer(s)	Variousopen-sourceandcommercialdevelopers
Initial release	1978(1978)
Operating system	UnixandUnix-like
Platform	Cross-platform
Type	Command

In computing,umaskis acommandthat determines the settings of amaskthat controls howfile permissionsare set for newly created files. It may also affect how the file permissions are changed explicitly.umaskis also afunctionthat sets the mask, or it may refer to the mask itself, which is formally known as thefile mode creation mask.The mask is a grouping ofbits,each of which restricts how its corresponding permission is set for newly created files. The bits in the mask may be changed by invoking theumaskcommand.

Overview

InUnix-likesystems, each file has a set of attributes that control who can read, write or execute it. When a program creates a file, the file permissions are restricted by the mask. If the mask has a bit set to "1", then the corresponding initial file permission will bedisabled.A bit set to "0" in the mask means that the corresponding permission will bedetermined by the programand thefile system.In other words, the mask acts as a last-stage filter that strips away permissions as a file is created; each bit that is set to a "1" strips away its corresponding permission. Permissions may be changed later by users and programs usingchmod.

Each program (technically called aprocess) has its own mask and is able to change its settings using a function call. When the process is ashell,the mask is set with theumaskcommand. When a shell or process launches a new process, the child process inherits the mask from its parent process. Generally, the mask only affects file permissions during the creation of new files and has no effect when file permissions are changed in existing files; however, thechmodcommand will check the mask when the mode options are specified using symbolic mode and a reference to a class of users is not specified.

The mask is stored as a group of bits. It may be represented asbinary,octalorsymbolicnotation. Theumaskcommand allows the mask to be set as octal (e.g.0754) or symbolic (e.g.u=,g=w,o=wx) notation.

Theumaskcommand is used withUnix-likeoperating systems, and theumaskfunction is defined in thePOSIX.1specification.

History

The mask, theumaskcommand and theumaskfunction were not part of the original implementation ofUNIX.The operating system evolved in a relatively small computer-center environment, where security was not an issue. It eventually grew to serve hundreds of users from different organizations. At first, developers made creation modes for key files more restrictive, especially for cases of actual security breaches, but this was not a general solution. The mask and theumaskcommand were introduced around 1978, in the seventh edition of the operating system,so it could allow sites, groups and individuals to choose their own defaults. The mask has since been implemented in most, if not all, of the contemporary implementations of Unix-like operating systems.

Shell command

In a shell, the mask is set by using theumaskcommand. The syntax of the command is:

umask[-S][maskExpression]

(The items within the brackets are optional.)

Displaying the current mask

If theumaskcommand is invoked without any arguments, it will display the current mask. The output will be in eitheroctalorsymbolicnotation, depending on the OS.

In mostshells,but not theC shell,the-Sargument (i.e.umask -S) will instructumaskto display using symbolic notation. For example:

$umask# display current value (as octal)
0022
$umask-S# display current value symbolically
u=rwx,g=rx,o=rx

Setting the mask using octal notation

If theumaskcommand is invoked with an octal argument, it will directly set the bits of the mask to that argument:

$umask007# set the mask to 007
$umask# display the mask (in octal)
0007# 0 - special permissions (setuid | setgid | sticky )
# 0 - (u)ser/owner part of mask
# 0 - (g)roup part of mask
# 7 - (o)thers/not-in-group part of mask
$umask-S# display the mask symbolically
u=rwx,g=rwx,o=

If fewer than 4 digits are entered, leading zeros are assumed. An error will result if the argument is not a valid octal number or if it has more than 4 digits.The three rightmost octal digits address the "owner", "group" and "other" user classes respectively. If a fourth digit is present, the leftmost (high-order) digit addresses three additional attributes, thesetuid bit,thesetgid bitand thesticky bit.

Octal codes

Octal digit in umaskcommand	Permissions the mask will prohibit from being set during file creation
0	any permission may be set (read, write, execute)
1	setting of execute permission is prohibited (read and write)
2	setting of write permission is prohibited (read and execute)
3	setting of write and execute permission is prohibited (read only)
4	setting of read permission is prohibited (write and execute)
5	setting of read and execute permission is prohibited (write only)
6	setting of read and write permission is prohibited (execute only)
7	all permissions are prohibited from being set (no permissions)

Setting the mask using symbolic notation

Whenumaskis invoked using symbolic notation, it will modify or set the flags as specified by themaskExpressionwith the syntax:

[user-class-letters]operatorpermission-symbols

Note that this syntax does not work when using theC shelldue to the different behaviour of its built-inumaskcommand.

MultiplemaskExpressionsare separated by commas.

A space terminates themaskExpression(s).

Thepermissionsare applied to different user classes:

Letter	Class	Description
u	user	the owner
g	group	users who are members of the file's group
o	others	users who are not the owner of the file or members of the group
a	all	all three of the above, the same asugo.(The default if nouser-class-lettersare specified in themaskExpression.)

Theoperatorspecifies how the permission modes of the mask should be adjusted.

Operator	Effect on the mask
+	permissions specified are enabled, permissions that are not specified are unchanged.
-	permissions specified are prohibited from being enabled, permissions that are not specified are unchanged.
=	permissions specified are enabled, permissions that are not specified are prohibited from being enabled.

Thepermission-symbolsindicate which file permission settings are to be allowed or prohibited by the mask.

Symbol	Name	Description
r	read	read a file or list a directory's contents
w	write	write to a file or directory
x	execute	execute a file or recurse a directory tree
X	special execute	SeeSymbolic modes.
s	setuid/gid	SeeFile permissions.
t	sticky	See File permissions.

For example:

umasku-w

Prohibitwrite permission from being set for theuser. The rest of the flags in the mask are unchanged.

Example of multiple changes:

umasku-w,g=r,o+r

This would set the mask so that it would:

1. prohibit thewrite permission from being set for theuser, while leaving the rest of the flags unchanged;
2. allow theread permission to be enabled for thegroup, while prohibitingwrite and execute permission for thegroup;
3. allow theread permission to be enabled forothers, while leaving the rest of theother flags unchanged.

Command line examples

Here are more examples of using theumaskcommand to change the mask:

umaskcommand issued	How the mask will affect permissions ofsubsequentlycreated files/directories
umask a+r	allows read permission to be enabled for all user classes; the rest of the mask bits are unchanged
umask a-x	prohibits enabling execute permission for all user classes; the rest of the mask bits are unchanged
umask a+rw	allows read or write permission to be enabled for all user classes; the rest of the mask bits are unchanged
umask +rwx	allows read, write or execute permission to be enabled for all user classes. (Note: On some UNIX platforms, this will restore the mask to a default.)
umask u=rw,go=	allow read and write permission to be enabled for the owner, while prohibiting execute permission from being enabled for the owner; prohibit enabling any permissions for the group and others
umask u+w,go-w	allow write permission to be enabled for the owner; prohibit write permission from being enabled for the group and others;
umask -S	display the current mask in symbolic notation
umask 777	disallow read, write, and execute permission for all (probably not useful because even owner cannot read files created with this mask!)
umask 000	allow read, write, and execute permission for all (potential security risk)
umask 077	allow read, write, and execute permission for the file's owner, but prohibit read, write, and execute permission for everyone else
umask 113	allow read or write permission to be enabled for the owner and the group, but not execute permission; allow read permission to be enabled for others, but not write or execute permission
umask 0755	equivalent tou-rwx,go=w.(The0specifies that thespecial modes(setuid, setgid, sticky) may be enabled.)

Example showing effect ofumask:

$umask-S# Show the (frequently initial) setting
u=rwx,g=rx,o=rx
$gcchello.c# compile and create executable file a.out
$ls-la.out
-rwxr-xr-x 1 me developer 6010 Jul 10 17:10 a.out
$# the umask prohibited Write permission for Group and Others
$ls>listOfMyFiles# output file created by redirection does not attempt to set eXecute
$ls-llistOfMyFiles
-rw-r--r-- 1 me developer 6010 Jul 10 17:14 listOfMyFiles
$# the umask prohibited Write permission for Group and Others
$############################################################
$umasku-w# remove user write permission from umask
$umask-S
u=rx,g=rx,o=rx
$ls>protectedListOfFiles
$ls-lprotectedListOfFiles
-r--r--r-- 1 me developer 6010 Jul 10 17:15 protectedListOfFiles
$rmprotectedListOfFiles
override r--r--r-- me/developer for protectedListOfFiles?
$# warning that protectedListOfFiles is not writable, answering Y will remove the file
$#####################################################################################
$umaskg-r,o-r# removed group read and other read from mask
$umask-S
u=rx,g=x,o=x
$ls>secretListOfFiles
$ls-lsecretListOfFiles
-r-------- 1 me developer 6010 Jul 10 17:16 secretListOfFiles

Mask effect

The mask is applied whenever a file is created. If the mask has a bit set to "1", that means the corresponding file permission will always bedisabledwhen files are subsequently created. A bit set to "0" in the mask means that the corresponding permission will bedetermined by the requesting processand theOSwhen files are subsequently created. In other words, the mask acts as a last-stage filter that strips away permissions as a file is created; each bit that is set to a "1" strips away that corresponding permission for the file.

How the mask is applied

How digits in theumaskcommand appears in the mask and eventually affects a program's request for creating a file with e.g. full (rwx) permissions

digit in umaskcommand	Binary in the mask	Negation of mask	Logical AND with "rwx" request
0	000	111	rwx
1	001	110	rw-
2	010	101	r-x
3	011	100	r--
4	100	011	-wx
5	101	010	-w-
6	110	001	--x
7	111	000	---

Programmatically, the mask is applied by the OS by first negating (complementing) the mask, and then performing a logical AND with the requested file mode. In the [probably] first UNIX manual to describe its function,the manual says,

the actual mode... of the newly-created file is the logical and of the given mode and the complement of the argument. Only the low-order 9 bits of the mask (the protection bits) participate. In other words, the mask shows [indicates] the bits to be turned off when files are created.

— UNIX Eighth Edition Manual, Bell Labs UNIX (manual), AT&T Laboratories

Exceptions

Many operating systems do not allow a file to be created with execute permissions. In these environments, newly created files will always have execute permission disabled for all users.

The mask is generally only applied to functions that create a new file; however, there are exceptions. For example, when usingUNIXandGNUversions ofchmodto set the permissions of a file, and symbolic notation is used, and no user is specified, then the mask is applied to the requested permissions before they are applied to the file. For example:

$umask0000
$chmod+rwxfilename
$ls-lfilename
-rwxrwxrwx filename
$umask0022
$chmod+rwxfilename
$ls-lfilename
-rwxr-xr-x filename

Processes

Eachprocesshas its own mask, which is applied whenever the process creates a new file. When a shell, or any other process, spawns a new process, the child process inherits the mask from its parent process.When the process is ashell,the mask is changed by theumaskcommand. As with other processes, any process launched from the shell inherits that shell's mask.

Mount option

In theLinux kernel,thefat,hfs,hpfs,ntfs,andudffile systemdrivers support aumaskmount option,which controls how the disk information is mapped to permissions. This is not the same as the per-process mask described above, although the permissions are calculated in a similar way. Some of these file system drivers also support separate masks for files and directories, using mount options such asfmask.

See also

• File system permissions