7

I'm trying to figure out how to use umask.

I ran umask 027 expecting this would result in all permissions for myself, read and execute for group, and none for everyone else.

Based on a default of 777 minus 027 = 750.

But when I run:

umask 027
touch test
ls -l test

I get back:

-rw-r----- 1 philip philip 0 Jun  3 12:14 test

This is not at all what I was expecting.

Where did I go wrong in my understanding of umask?

Philip Kirkbride
  • 10,236
  • 1
    The default (and maximum) for a file is 666; for a directory it is 777. Try making a directory and checking. Depending on your distro, you may be able to do umask -S to obtain some additional information. Also, it is not actually "subtraction" as implied, but a bitwise operation. Please see How is umask calculated in Linux. – KevinO Jun 03 '17 at 16:41
  • 1
    I think your assumption of default value is not correct for files. 777 is for directories, whereas 666 is for files. So in your case, 666-027 will result in 640 as you get in result. More info here: https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html – fduff Jun 03 '17 at 16:42
  • 2
    Possible duplicate of How umask works – Jeff Schaller Jun 03 '17 at 19:11

1 Answers1

9

The umask cannot add permissions, it only servers to mask away some of the permission bits set by the process creating the file in question.

The umask is used by open(2), mkdir(2), and other system calls that create files to modify the permissions placed on newly created files or directories. Specifically, permissions in the umask are turned off from the mode argument to open(2) and mkdir(2).

(manual page umask(2))

touch creates files with permissions 0666, as most other applications do when not creating something explicitly known to be private, or something that should be executable (in which case they'd use 0600 or 0777 respectively). If the umask could be used to force adding permission bits, stuff like email clients and ssh-keygen would be in trouble: they'd have no way to create files that can only be accessed by the owner!

$ umask 027; rm xxx; strace -etrace=open touch xxx 2>&1 | grep xxx ;  ls -l xxx
open("xxx", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
-rw-r----- 1 itvirta itvirta 0 Jun  3 20:40 xxx

If we arrange for the file to be created with wider permissions, we see the execute bits too:

$ umask 027; rm yyy; 
$ perl -MFcntl -e 'sysopen F, "yyy", O_WRONLY|O_CREAT, 0777'
$ ls -l yyy
-rwxr-x--- 1 itvirta itvirta 0 Jun  3 20:40 yyy*

Similarly we could create a directory without the x bits set...

$ perl -MFcntl -e 'mkdir "ddd", 0666'
$ ls -ld  ddd
drw-r----- 2 itvirta itvirta 4096 Jun  3 20:45 ddd/
ilkkachu
  • 138,973