The Logic of Linux File Creation
In the Linux operating system, security is paramount. When you create a brand new file or a new directory, Linux does not randomly guess what permissions that file should have. It uses a strict, predefined mathematical formula to determine exactly who is allowed to read, write, or execute the new item.
By absolute default, if there were no restrictions, Linux would grant maximum permissions:
- New Directories:
777(Everyone can read, write, and execute/enter). - New Files:
666(Everyone can read and write; files are never executable by default for safety).
Obviously, allowing everyone on the system to write to every new file you create is a massive security risk. This is where the umask (user file-creation mode mask) command comes in. The umask acts as a filter that subtracts permissions from the absolute maximum defaults every time you create something new.
Step 1: Viewing Your Current Umask
Before you change anything, you should check what your current filter is.
Open your terminal and simply type:
umask
You will typically see a four-digit octal number, such as 0022. (For the purposes of permissions, you can usually ignore the first zero, treating it as 022).
Step 2: Understanding Umask Math
The umask value is subtracted from the base permissions.
If your umask is 022, here is what happens when you create a new directory (base 777):
- 777 (Maximum default)
- -022 (Your umask filter)
- = 755 (Final permissions)
A permission of 755 means you (the owner) have full control (7), but the group (5) and others (5) can only read and execute, not write. This is a very standard, secure default for directories.
Now, let’s look at creating a new text file (base 666):
- 666 (Maximum default)
- -022 (Your umask filter)
- = 644 (Final permissions)
A permission of 644 means you can read and write (6), but the group (4) and others (4) can only read. Again, this protects your files from being altered by other users on a shared server.
Step 3: Changing the Umask Temporarily
Suppose you are working on a collaborative project. You want every file you create in the next hour to be fully writable by anyone in your shared group, rather than just yourself.
You need to change your umask to 002.
- Directories: 777 – 002 = 775 (Group can write)
- Files: 666 – 002 = 664 (Group can write)
To change this, simply run:
umask 002
Any file you create in that specific terminal session will now be created with the 664 permissions.
Step 4: Making the Umask Permanent
If you close the terminal window and open a new one, the umask will revert back to its system default (usually 022).
If you want to permanently alter the default permissions for all future files you create, you must add the command to your shell profile configuration file (typically ~/.bashrc or ~/.zshrc).
- Open the configuration file in a text editor like Nano:
nano ~/.bashrc - Scroll to the very bottom of the file.
- Add the line:
umask 027(This is an example of a highly secure mask where the group can read, but “others” have zero access). - Save and exit the file (Ctrl+O, Enter, Ctrl+X).
- Apply the changes immediately by running:
source ~/.bashrc
Step 5: The Symbolic Alternative
Calculating octal math (777 – 022) can be confusing for beginners.
Fortunately, the umask command also supports symbolic notation, similar to the chmod command. Instead of calculating what permissions you want to subtract, you explicitly state what permissions you want the resulting files to have.
To view your current umask in readable symbols, run:
umask -S
It will output something like: u=rwx,g=rx,o=rx.
To set a highly restrictive mask where only you have access, and groups and others have absolutely nothing, you can type:
umask u=rwx,g=,o=