Setting Default File Permissions with umask

What is umask?

The umask (user mask) is a four-digit octal number that your shell uses to determine the default permissions for new files and directories. It works by "masking" or removing permissions from a base value.

The system starts with two default base permissions:

• For files: 666 (rw-rw-rw-). Files are not given execute permissions by default as a security precaution.
• For directories: 777 (rwxrwxrwx). Directories need the execute bit to be accessible.

The umask value is then subtracted from these base permissions to get the final permissions. For example, a common umask is 0022.

• New file: 666 - 022 = 644 (rw-r--r--)
• New directory: 777 - 022 = 755 (rwxr-xr-x)

Let's watch a short video that introduces this concept.

Checking and Interpreting Your umask

You can easily check the current umask for your shell session. Open your terminal and run:

umask

This command will print the umask value in its octal form (e.g., 0022).

You can also view it in a more human-readable, symbolic format using the -S flag:

umask -S

This will show you the permissions that will be granted to new files, like u=rwx,g=rx,o=rx.

Do It Yourself: Verify Your Default Permissions

Let's confirm this logic with a hands-on exercise.

1. Check your umask:

   umask
   

   Take note of the value. On a standard Fedora system, it's likely 0002 for regular users if you're in a private group, or 0022 if not.

2. Create a test file and directory:

   touch umask_test_file.txt
   mkdir umask_test_dir
   

3. Check their permissions:

   ls -l umask_test_file.txt
   ls -ld umask_test_dir 
   

   (Remember to use ls -ld for a directory to see its own permissions, not its contents).

4. Do the math: Take the base permissions (666 for the file, 777 for the directory) and subtract your umask value. Does the result match the permissions you see in the ls -l output? For example, if your umask is 0022, you should see 644 (rw-r--r--) for the file and 755 (rwxr-xr-x) for the directory.

If you'd like a more detailed written explanation of this calculation, the umask section of the freeCodeCamp article we used in the last lesson is an excellent resource.

Changing the umask

You can change the umask for your current terminal session. This is useful when you need to create a set of files with different default permissions than usual.

For example:

• umask 0077: A very restrictive setting. This removes all permissions for the group and others (666 - 077 = 600). New files will only be accessible by you.
• umask 0002: A collaborative setting. This removes only the write permission for others, allowing your group members to write to files you create (666 - 002 = 664).

The following video clip demonstrates how to change the umask and discusses the security implications of different values.

This table is a great reference for how common umask values affect permissions.

Do It Yourself: Experiment with umask

1. Set a restrictive umask:

   umask 0077
   umask # Confirm it's set
   touch private_file.txt
   ls -l private_file.txt
   

   You should see the permissions are -rw------- (600). No one but you can read or write to it.

2. Set a collaborative umask:

   umask 0002
   umask # Confirm it's set
   touch group_file.txt
   ls -l group_file.txt
   

   You should see the permissions are -rw-rw-r-- (664). Your group members can now write to this file.

3. Clean up:

   rm umask_test_file.txt private_file.txt group_file.txt
   rmdir umask_test_dir
   

   Important: When you close your terminal, the umask will revert to the default.

Making umask Changes Permanent

To change your default umask permanently for your user account, you need to add the umask command to your shell's startup file. For the Bash shell on Fedora, this is typically ~/.bashrc.

The following article explains how to do this.

Conclusion

You've now mastered the final piece of the standard Linux permissions puzzle! You can not only modify permissions after the fact but also control them right at the moment of creation. This proactive approach is fundamental to good system administration and security.

Key Takeaways:

• umask sets the default permissions for new files and directories.
• It works as a mask, removing permissions from the base values of 666 (files) and 777 (directories).
• You can check your current mask with umask (octal) or umask -S (symbolic).
• A common secure default is 0022, resulting in 644 files and 755 directories.
• A collaborative umask like 0002 allows group members to write to new files.
• You can change the umask temporarily for your session or permanently by editing your ~/.bashrc file.

In our next lesson, we'll move beyond the traditional permission model. As you requested, we'll begin our exploration of SELinux (Security-Enhanced Linux), a powerful security layer built into Fedora. We will start by learning what SELinux is, how to check its status, and understanding its different operational modes.