About this article
This article was created using an automated generation workflow leveraging generative AI. It reviews public specifications for Linux file permissions and umask, safely observes differences in a temporary directory, and organizes their implications for service operations.Verification status: 📘 Specifications verified, execution unverified
umask 022 and 077 tend to be memorized by rote, but the important thing is that it is a mechanism that determines which permissions should be withheld from newly created files or directories from the start.
First test
d=$(mktemp -d) cd "$d" umask 022 touch a.txt stat -c '%a %n' a.txt
Typically, it is as follows.
644 a.txt
Next, change it.
umask 077 touch b.txt stat -c '%a %n' b.txt
This time, it normally becomes
600 b.txt
.
Not a simple subtraction like "666 – 022"
Explanations sometimes write 666 - 022 = 644, but the essence of umask is not arithmetic subtraction, but dropping masked bits from the permission bits.
Since regular files do not include execution bits by default, the baseline is mainly 666, while for directories, 777 is the baseline.
flowchart LR A[作成時の基準mode] --> B[umaskで禁止bitを落とす] B --> C[実際の初期mode]
Directories yield different results
umask 022 mkdir dir022 umask 077 mkdir dir077 stat -c '%a %n' dir022 dir077
Generally, you can observe the difference between 755 and 700.
In other words, umask applies not only to regular files but also to newly created directories.
Difference from chmod
umask: Items to be newly createdAffects initial permissionschmod: Already existing itemsChanges the mode
umask 077 Even if you change it to , existing 644 files do not automatically become 600.
Practical applications
This is especially useful when applications or batch jobs generate files containing sensitive data.
Backup files
Temporary files
Saved API responses
Private keys and configuration files
Batch output logs
Working files generated by services
For example, by explicitly setting umask 077 at the start of processing, you can place files created by that process into an initial state that is difficult for other users to read.
The umask checked in the shell is not necessarily the same as the service umask
systemd services, cron jobs, containers, and the application itself may configure a different umask.
Rather than assuming "my SSH session uses 077 so the service must use 077 too," verify which execution context is actually used to create the files.
In systemd, this can often be explicitly set using UMask= in the unit configuration.
Cautions
Making umask stricter is not always better. Creating files intended for sharing among multiple users or groups with 077 can sometimes obstruct necessary collaboration.
In practice, values are chosen after determining:
who needs to read them
who needs to write to them
whether access should be restricted from initial creation
whether group sharing is necessary
.
Cleanup
cd / rm -rf "$d"
Summary
umask controls initial permissions upon creation
It has a different role from chmod
Regular files and directories have different baseline modes
Services may have a different umask than the shell
Explicit umasks help prevent accidents with generated artifacts containing sensitive data
