| umask | |
| Author: | AT&T Bell Laboratories |
| Developer: | Various open-source and commercial developers |
| Operating System: | Unix and Unix-like |
| Platform: | Cross-platform |
| Genre: | Command |
In computing, umask is a command that determines the settings of a mask that controls how file permissions are set for newly created files. It may also affect how the file permissions are changed explicitly. is also a function that sets the mask, or it may refer to the mask itself, which is formally known as the file mode creation mask. The mask is a grouping of bits, each of which restricts how its corresponding permission is set for newly created files. The bits in the mask may be changed by invoking the command.
In Unix-like systems, each file has a set of attributes that control who can read, write or execute it. When a program creates a file, the file permissions are restricted by the mask. If the mask has a bit set to "1", then the corresponding initial file permission will be disabled. A bit set to "0" in the mask means that the corresponding permission will be determined by the program and the file system. In other words, the mask acts as a last-stage filter that strips away permissions as a file is created; each bit that is set to a "1" strips away its corresponding permission. Permissions may be changed later by users and programs using [[chmod]].
Each program (technically called a process) has its own mask and is able to change its settings using a function call. When the process is a shell, the mask is set with the command. When a shell or process launches a new process, the child process inherits the mask from its parent process. Generally, the mask only affects file permissions during the creation of new files and has no effect when file permissions are changed in existing files; however, the command will check the mask when the mode options are specified using symbolic mode and a reference to a class of users is not specified.
The mask is stored as a group of bits. It may be represented as binary, octal or symbolic notation. The command allows the mask to be set as octal (e.g.) or symbolic (e.g.) notation.
The command is used with Unix-like operating systems, and the function is defined in the POSIX.1 specification.
The mask, the command and the function were not part of the original implementation of UNIX. The operating system evolved in a relatively small computer-center environment, where security was not an issue. It eventually grew to serve hundreds of users from different organizations. At first, developers made creation modes for key files more restrictive, especially for cases of actual security breaches, but this was not a general solution. The mask and the command were introduced around 1978, in the seventh edition of the operating system,[1] so it could allow sites, groups and individuals to choose their own defaults. The mask has since been implemented in most, if not all, of the contemporary implementations of Unix-like operating systems.
In a shell, the mask is set by using the command. The syntax of the command is:[2]
(The items within the brackets are optional.)
If the command is invoked without any arguments, it will display the current mask. The output will be in either octal or symbolic notation, depending on the OS.
In most shells, but not the C shell, the argument (i.e.) will instruct to display using symbolic notation. For example:
If the command is invoked with an octal argument, it will directly set the bits of the mask to that argument:
If fewer than 4 digits are entered, leading zeros are assumed. An error will result if the argument is not a valid octal number or if it has more than 4 digits.[3] The three rightmost octal digits address the "owner", "group" and "other" user classes respectively. If a fourth digit is present, the leftmost (high-order) digit addresses three additional attributes, the setuid bit, the setgid bit and the sticky bit.
| Octal digit in command | Permissions the mask will prohibit from being set during file creation | |
|---|---|---|
0 | any permission may be set (read, write, execute) | |
1 | setting of execute permission is prohibited (read and write) | |
2 | setting of write permission is prohibited (read and execute) | |
3 | setting of write and execute permission is prohibited (read only) | |
4 | setting of read permission is prohibited (write and execute) | |
5 | setting of read and execute permission is prohibited (write only) | |
6 | setting of read and write permission is prohibited (execute only) | |
7 | all permissions are prohibited from being set (no permissions) |
When is invoked using symbolic notation, it will modify or set the flags as specified by the maskExpression with the syntax:
Note that this syntax does not work when using the C shell due to the different behaviour of its built-in command.
Multiple maskExpressions are separated by commas.
A space terminates the maskExpression(s).
The permissions are applied to different user classes:
| Letter | Class | Description | |
|---|---|---|---|
u | user | the owner | |
g | group | users who are members of the file's group | |
o | others | users who are not the owner of the file or members of the group | |
a | all | all three of the above, the same as ugo. (The default if no user-class-letters are specified in the maskExpression.) |
The operator specifies how the permission modes of the mask should be adjusted.
| Operator | Effect on the mask | |
|---|---|---|
+ | permissions specified are enabled, permissions that are not specified are unchanged. | |
- | permissions specified are prohibited from being enabled, permissions that are not specified are unchanged. | |
= | permissions specified are enabled, permissions that are not specified are prohibited from being enabled. |
The permission-symbols indicate which file permission settings are to be allowed or prohibited by the mask.
| Symbol | Name | Description | |
|---|---|---|---|
r | read | read a file or list a directory's contents | |
w | write | write to a file or directory | |
x | execute | execute a file or recurse a directory tree | |
X | special execute | See Symbolic modes. | |
s | setuid/gid | See File permissions. | |
t | sticky | See File permissions. |
For example:
Example of multiple changes:
This would set the mask so that it would:
Here are more examples of using the command to change the mask:
| command issued | How the mask will affect permissions of subsequently created files/directories |
|---|---|
umask a+r | allows read permission to be enabled for all user classes; the rest of the mask bits are unchanged |
umask a-x | prohibits enabling execute permission for all user classes; the rest of the mask bits are unchanged |
umask a+rw | allows read or write permission to be enabled for all user classes; the rest of the mask bits are unchanged |
umask +rwx | allows read, write or execute permission to be enabled for all user classes. (Note: On some UNIX platforms, this will restore the mask to a default.) |
umask u=rw,go= | allow read and write permission to be enabled for the owner, while prohibiting execute permission from being enabled for the owner; prohibit enabling any permissions for the group and others |
umask u+w,go-w | allow write permission to be enabled for the owner; prohibit write permission from being enabled for the group and others; |
umask -S | display the current mask in symbolic notation |
umask 777 | disallow read, write, and execute permission for all (probably not useful because even owner cannot read files created with this mask!) |
umask 000 | allow read, write, and execute permission for all (potential security risk) |
umask 077 | allow read, write, and execute permission for the file's owner, but prohibit read, write, and execute permission for everyone else |
umask 113 | allow read or write permission to be enabled for the owner and the group, but not execute permission; allow read permission to be enabled for others, but not write or execute permission |
umask 0755 | equivalent to u-rwx,go=w. (The 0 specifies that the special modes (setuid, setgid, sticky) may be enabled.) |
Example showing effect of :
The mask is applied whenever a file is created. If the mask has a bit set to "1", that means the corresponding file permission will always be disabled when files are subsequently created. A bit set to "0" in the mask means that the corresponding permission will be determined by the requesting process and the OS when files are subsequently created. In other words, the mask acts as a last-stage filter that strips away permissions as a file is created; each bit that is set to a "1" strips away that corresponding permission for the file.
| digit in command | Binary in the mask | Negation of mask | Logical AND with "rwx" request[4] | |
|---|---|---|---|---|
| 0 | 000 | 111 | rwx | |
| 1 | 001 | 110 | rw- | |
| 2 | 010 | 101 | r-x | |
| 3 | 011 | 100 | r-- | |
| 4 | 100 | 011 | -wx | |
| 5 | 101 | 010 | -w- | |
| 6 | 110 | 001 | --x | |
| 7 | 111 | 000 | --- |
Programmatically, the mask is applied by the OS by first negating (complementing) the mask, and then performing a logical AND with the requested file mode. In the [probably] first UNIX manual to describe its function,[5] the manual says,
Many operating systems do not allow a file to be created with execute permissions. In these environments, newly created files will always have execute permission disabled for all users.
The mask is generally only applied to functions that create a new file; however, there are exceptions. For example, when using UNIX and GNU versions of to set the permissions of a file, and symbolic notation is used, and no user is specified, then the mask is applied to the requested permissions before they are applied to the file. For example:
Each process has its own mask, which is applied whenever the process creates a new file. When a shell, or any other process, spawns a new process, the child process inherits the mask from its parent process. When the process is a shell, the mask is changed by the command. As with other processes, any process launched from the shell inherits that shell's mask.
In the Linux kernel, the fat, hfs, hpfs, ntfs, and udf file system drivers support a umask mount option, which controls how the disk information is mapped to permissions. This is not the same as the per-process mask described above, although the permissions are calculated in a similar way. Some of these file system drivers also support separate masks for files and directories, using mount options such as [[fmask]].