Permissions with the umask Command
When I’ve created files, they’ve had read+write permissions for the owner and group, but no access allowed for anyone else. When you create files on your system, you might find that the default permissions are different.
The controlling variable behind the default permissions is called the file creation mask, or umask for short.
Inexplicably, umask doesn’t always list its value as a three-digit number, but you can find its value in the same way you figured out the numeric permissions strings for chmod. For example, when I enter umask, the system indicates that my umask setting is 07. A leading zero has been dropped, so the actual value is 007, a value that British MI6 could no doubt appreciate! But 007 doesn’t mean that the default file is created with read+write+execute for everyone else and no permissions for the owner or group. It means quite the opposite, literally. The umask command is a filter through which permissions are pushed to ascertain what remains. Figure 5.8 demonstrates how this works.
Think of your mask as a series of boxes: if the value is true, the information can’t exude through the box. If the value is false, it can. Your mask is therefore the direct opposite to how you want your permissions to be set. In Figure 5.8, I want to have 770 as the default permission for any new file or directory I create, so I want to specify the exact opposite of that, 007. Sure enough, with this umask value, when I create new files, the default permission allows read and write access to the owner and group, but no access to anyone else.
5
Things are a bit trickier than that. You’ve probably already asked yourself, “Why, if I have 007 as my mask (which results in 770 as the default permissions), do my files have 660 as the actual default permission?”
The reason is that UNIX tries to be smart about the execute permission setting. If I create a directory, UNIX knows that execute permission is important, and so it grants it. However, for some files (particularly text files), execute permission doesn’t make sense, so UNIX actually masks it out internally.
Another way to look at this is that any time you create a file containing information, the original mask that the system uses to compare against your umask is not 777 (not rwxrwxrwx, to put it another way), but rather 666 (rw-rw-rw-), in recognition of the unlikelihood that you’ll want to execute the new file.
The good news is that you now know an easy way to set the execute permission for a file if the system gets it wrong: chmod +x filename does the trick.
Figure 5.8.
Interpreting the umask value.
1. Turn to your computer and check your umask setting, then alternate between changing its values and creating new files with touch:
% umask
7
% touch test.07
% ls -l test.07
-rw-rw---- 1 taylor 0 Oct 12 14:38 test.07
2. To change the value of your umask, add the numeric value of the desired mask to the command line:
% umask 077
This changes my umask value from 007 (---rwx) to 077 (---rwxrwx). Before you look at the following listing, what would you expect this modification to mean? Remember, you should read it as the exact opposite of how you want the default permissions.
% touch test.077 % ls -l test.077
-rw--- 1 taylor 0 Oct 12 14:38 test.077 Is that what you expected?
3. What would you do if you wanted to have the default permission keep files private to just the owner and make them read-only?
You can work through this problem in reverse. If you want r-x--- as the default permission (since the system takes care of whether execute permission is needed, based on file type), write down the opposite permission, which is -w-rwxrwx. Translate that to a binary number, 010 111 111, and then to a three-digit value, 277 (010=2, 111=7, 111=7). That’s the answer. The value 277 is the correct umask value to ensure that files you create are read-only for yourself and off-limits to everyone else.
% umask 277
% touch test.277
% ls -l test.277
-r--- 1 taylor 0 Oct 12 14:39 test.277
4. What if you wanted to have files created with the default permission being read- only for everyone, read-write for the group, but read-only for the owner? Again, work backwards. The desired permission is r-xrwxr-x, so create the opposite value (-w---w-), translate it into binary (010 000 010), and then translate that into a three-digit value: 202 (010=2, 000=0, 010=2).
5
As a rule of thumb, it’s best to leave the execute permission enabled when building umask values so the system doesn’t err when creating directories.
The umask is something set once and left alone. If you’ve tried various experiments on your computer, remember to restore your umask back to a sensible value to avoid future problems (though each time you log in to the system it’s reset to your default value). In the next hour, you learn how to use the mkdir command to create new directories, and you see how the umask value affects default directory access permissions.