Default Permissions

When you create files or directories on a Linux system, their initial permissions are determined automatically. If you don’t control this mechanism, newly created files might be too open (readable by others) or too restrictive for collaboration. Understanding the umask (user file-creation mode mask) lets you define a safe baseline and prevent accidental exposure of sensitive data. By default, without any umask applied, the presumptive permissions are:

Files: 666 (rw-rw-rw-)
Directories: 777 (rwxrwxrwx)

An infographic explaining the Unix/Linux "umask" concept: it shows creating a file or directory passing through umask to produce default permissions. Examples given are file default 666 (rw-rw-rw) and directory default 777 (rwxrwxrwx).

How umask works

The umask subtracts (masks off) permission bits from those defaults when a file or directory is created.
Practically, umask is subtractive: bits set in the umask are removed from the default permission sets (files: 666, directories: 777).
You can set umask temporarily for the current shell session with the umask command, or persist it by adding it to shell startup files (per-user) or system-wide scripts.

umask is subtractive: the bits set in the umask are removed from the defaults (666 for files, 777 for directories).

Common examples

umask	Resulting file perms	Resulting directory perms	Explanation
`0022`	`644` (`rw-r--r--`)	`755` (`rwxr-xr-x`)	Removes write for group/other: `666 - 022 = 644`, `777 - 022 = 755`.
`0002`	`664` (`rw-rw-r--`)	`775` (`rwxrwxr-x`)	Keeps group write, removes other write.
`0077`	`600` (`rw-------`)	`700` (`rwx------`)	Removes all group/other permissions.
`0000`	`666` (`rw-rw-rw-`)	`777` (`rwxrwxrwx`)	No masking; fully permissive defaults.

Demonstration: runtime umask and its effects

Scenario: perform operations as user student, check current umask, create directories/files, and inspect permissions/ACLs.

# Check current umask (example shows 0022)
student@control:~$ umask
0022

# Create a directory and view its ACL (mask applied to default 777)
student@control:~$ mkdir umask
student@control:~$ getfacl umask/
# file: umask/
# owner: student
# group: student
user::rwx
group::r-x
other::r-x

# Set a more restrictive umask for this session: remove all group/other permissions
student@control:~$ umask 0077

# Recreate the directory to see the new defaults applied
student@control:~$ rm -rf umask/
student@control:~$ mkdir umask
student@control:~$ getfacl umask
# file: umask
# owner: student
# group: student
user::rwx
group::----
other::----

# Create a file inside and list it
student@control:~$ touch umask/file1
student@control:~$ ls -l umask/
total 0
-rw--------. 1 student student 0 Apr 20 16:31 file1
student@control:~$

Explanation of the demo

With umask 0022, group and others lose write permission: directory 755, file 644.
With umask 0077, group and others lose all permissions: only the owner retains full access—directories 700, files 600. The file listing shows -rw--------.

Note: umask set from the shell applies only to that shell session. Logging out and back in resets the runtime umask to whatever is configured for the account. Persisting a umask for a single user

To make a user’s umask persistent, add a umask line to their shell startup file (for example, ~/.bashrc, ~/.profile, or ~/.bash_profile depending on shell and distribution).

Example ~/.bashrc snippet (add umask 0077 at the end):

# Source global definitions
if [ -f /etc/bashrc ]; then
	. /etc/bashrc
fi

# User specific environment
if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]]; then
	PATH="$HOME/.local/bin:$HOME/bin:$PATH"
fi
export PATH

# Uncomment the following line if you don't like systemctl's auto-paging feature:
# User specific aliases and functions
if [ -d ~/.bashrc.d ]; then
	for rc in ~/.bashrc.d/*; do
		if [ -f "$rc" ]; then
			. "$rc"
		fi
	done
fi
unset rc

# Set a secure default umask for this user
umask 0077

After saving the file, log in again to confirm:

student@control:~$ su - student
Password:
Last login: Mon Apr 20 14:48:55 EEST 2026 on tty2
student@control:~$ umask
0077
student@control:~$

Persisting a umask system-wide

To enforce a default umask for all interactive logins, place a small script containing the umask command in /etc/profile.d/. Files ending with .sh in that directory are sourced by /etc/profile on login shells.

Better practice: create /etc/profile.d/umask.sh:

# As root or with sudo:
echo 'umask 0077' | sudo tee /etc/profile.d/umask.sh
sudo chmod 0644 /etc/profile.d/umask.sh

Ensure the script is readable by all users (mode 0644); otherwise it may not be sourced when /etc/profile iterates files in that directory. Example listing showing the umask.sh file with proper permissions:

$ ls -l /etc/profile.d | grep umask.sh
-rw-r--r--. 1 root root 11 Apr 20 16:36 umask.sh

After creating the file, new login sessions will inherit the system-wide umask:

# Create a test user and log in (example)
sudo useradd -m test
sudo passwd test

# Then switch to test and confirm
su - test
Password:
test@control:/home/test$ umask
0077

If a script in /etc/profile.d/ is not world-readable (ensure mode 0644), non-root logins may not source it. Set the file’s permissions so it can be read by all users.

Troubleshooting and tips

If your expected umask is not applied:
- Check shell startup order (/etc/profile, ~/.bash_profile, ~/.bashrc, ~/.profile) for overriding umask settings.
- System services and non-interactive shells (cron, systemd units) might not source the same files—set umask appropriately within service unit files or the specific environment.
- For Samba, FTP servers, or other services, consult their configuration options; they may have their own create mask/directory mask settings.
Use getfacl to confirm ACLs and effective permissions if extended ACLs are in use.

Summary

umask controls default permissions by subtracting bits from file (666) and directory (777) defaults.
umask set in a shell affects only that session; persist per-user in ~/.bashrc/~/.profile or system-wide via /etc/profile.d/*.sh.
Always ensure /etc/profile.d/*.sh scripts are readable (0644) so they’re applied to all users.
Choosing a secure default like 0077 helps prevent accidental exposure by ensuring new files and directories are owner-only by default.

Links and references

This article explained how Linux assigns default filesystem permissions, how to test umask values at runtime, and how to persist umask settings for individual users or system-wide to establish consistent baseline security.

Introduction

Working with the Command Line

File Management

Working with Text Files

Output Redirection

User Management

Linux Permissions

Enhanced Command Line

Storage Management

Managing Services

Controlling the Boot Process

Scheduling Future Tasks

Working with Logs

Installing Software

Process Management & Tuning

Managing Network Configuration and Security

SELinux

Configuring SSH

Default Permissions

Watch Video

Practice Lab