Umask

History

The mask, the umask command and the umask function were not part of the original implementation of UNIX. The operating system evolved in a relatively small computer center environment where security was not an issue. It eventually grew to serve hundreds of users from different organizations. At first, developers made creation modes for key files more restrictive, especially for cases of actual security breaches, but this was not a general solution. The mask and the umask command were introduced around 1978 between the sixth edition and the eighth edition of the operating system, so it could allow sites, groups and individuals to choose their own defaults. The mask has since been implemented in most, if not all, of the contemporary implementations of Unix-like operating systems.

Shell command

In a shell, the mask is set by using the umask command. The syntax of the command is:

(the items within the [brackets] are optional)

Displaying the current mask

If the umask command is invoked without any arguments, it will display the current mask. The output will be in either octal or symbolic notation depending on the OS. The -S argument (i.e. umask -S) will force umask to display using symbolic notation. For example:

Setting the mask using octal notation

If the umask command is invoked with an octal argument, it will directly set the bits of the mask to that argument:

If fewer than 4 digits are entered, leading zeros are assumed. An error will result if the argument is not a valid octal number or if it has more than 4 digits. The three rightmost octal digits address the 'owner', 'group' and 'other' user classes, respectively. If a fourth digit is present, the leftmost (high-order) digit addresses three additional attributes, the setuid bit, the setgid bit and the sticky bit.

Setting the mask using symbolic notation

When umask is invoked using symbolic notation, it will modify or set the flags as specified by the maskExpression with the syntax :

Multiple maskExpressions are separated by commas.

A space terminates the maskExpression (s).

For example:

Prohibit write permission from being set for the user. The rest of the flags in the mask are unchanged.

Example of multiple changes:

This would set the mask so that it would:

1. prohibit the write permission from being set for the user, while leaving the rest of the flags unchanged;
2. allow the read permission to be enabled for the group, while prohibiting write and execute permission for the group;
3. allow the read permission to be enabled for others, while leaving the rest of the other flags unchanged.

Command line examples

Here are more examples of using the umask command to change the mask.

Example showing effect of umask:

Mask effect

The mask is applied whenever a file is created. If the mask has a bit set to "1", that means the corresponding file permission will always be disabled when files are subsequently created. A bit set to "0" in the mask means that the corresponding permission will be determined by the requesting process and the OS when files are subsequently created. In other words, the mask acts as a last-stage filter that strips away permissions as a file is created; each bit that is set to a "1" strips away that corresponding permission for the file.

Truth table

Here is the truth table for the masking logic. Each bit in the requesting process' file permission mode is operated on by the mask using this logic to yield the permission mode that is applied to the file as it is created. (p is a bit in the requested file permission mode of a process that is creating a file; q is a bit in the mask; r is the resulting bit in the created file's permission mode)

How the mask is applied

Programmatically, the mask is applied by the OS by first negating (complementing) the mask, and then performing a logical AND with the requested file mode. In the [probably] first UNIX manual to describe its function, the manual says,

"the actual mode... of the newly-created file is the logical and of the given mode and the complement of the argument. Only the low-order 9 bits of the mask (the protection bits) participate. In other words, the mask shows [indicates] the bits to be turned off when files are created."

In boolean logic the application of the mask can be represented as

C: (P&(~Q))

This says that the file's permission mode (C) is a result of a logical AND operation between the negation of the mask (Q), and the process' requested permission mode setting (P).

Exceptions

Note: Many operating systems do not allow a file to be created with execute permissions. In these environments, newly created files will always have execute permission disabled for all users.

The mask is generally only applied to functions that create a new file, however, there are exceptions. For example, when using UNIX and GNU versions of chmod to set the permissions of a file, and symbolic notation is used, and no user is specified, then the mask is applied to the requested permissions before they are applied to the file. For example:

Processes

Each process has its own mask, which is applied whenever the process creates a new file. When a shell, or any other process, spawns a new process, the child process inherits the mask from its parent process. When the process is a shell, the mask is changed by the umask command. As with other processes, any process launched from the shell inherits that shell's mask.

Mount option

In the Linux kernel, the fat, hfs, hpfs, ntfs, and udf file system drivers support a umask mount option, which controls how the disk information is mapped to permissions. This is not the same as the per-process umask described above, although the permissions are calculated in a similar way. Some of these file system drivers also support separate umasks for files and directories, using mount options such as fmask.