Shell builtins · bash builtin

`umask`

Show or set the mask that removes permission bits from newly created files and directories.

umask [-p] [-S] [MODE]

10 of 10 examples run in Debian 13.7 on 2026-10-31 · manual: bash(1)

Programs that create files ask for generous permissions: usually 666 (read and write for everyone) for files and 777 for directories. The umask is a per-process mask of bits to take away from that request. With the common umask 022, the write bit is removed for group and others, so new files come out 644 (rw-r--r--) and directories 755 (rwxr-xr-x).

It is a subtraction of bits, not of numbers: each 1 bit in the mask clears that permission. A umask never adds permissions, which is why new files are never executable no matter what the umask is; that takes an explicit chmod +x. It only affects files as they are created; existing files and later chmod calls are untouched.

umask is a shell builtin because the mask belongs to the process: it applies to the shell and everything started from it. Set it in ~/.bashrc or ~/.profile for yourself, at the top of a script that writes sensitive files, or in a subshell for a single command.

Examples

Show the current umask

$ umask

explain

output

Four octal digits; the leading 0 is for the special bits (setuid, setgid, sticky). 022 masks write permission for group and others.

Show it as the permissions that remain

$ umask -S

explain

output

u=rwx,g=rx,o=rx

-S prints the complement: the permissions new directories can get. It is easier to read than the octal mask.

See the effect on new files and directories

$ touch new.txt; mkdir newdir
> ls -ld new.txt newdir

output

-rw-r--r-- 1 dev dev 0 Oct 31 20:21 new.txt
drwxr-xr-x 2 dev dev 2 Oct 31 20:21 newdir

666 minus the 022 bits gives rw-r--r-- for the file; 777 minus them gives rwxr-xr-x for the directory.

Create files only you can read

$ umask 077
> touch secret.txt; mkdir private
> ls -ld secret.txt private

output

drwx------ 2 dev dev 2 Oct 31 20:21 private
-rw------- 1 dev dev 0 Oct 31 20:21 secret.txt

077 masks every group and other bit, so the file is rw------- and the directory rwx------. Use this at the top of scripts that write keys, tokens or backups.

Share with your group, hide from others

$ umask 007
> touch shared.txt; mkdir team
> ls -ld shared.txt team

output

-rw-rw---- 1 dev dev 0 Oct 31 20:21 shared.txt
drwxrwx--- 2 dev dev 2 Oct 31 20:21 team

007 keeps full access for the owner and group and removes everything for others: a good default for a shared project directory.

See that umask never adds the execute bit

$ umask 000
> touch script.sh
> ls -l script.sh

output

-rw-rw-rw- 1 dev dev 0 Oct 31 20:21 script.sh

Even with an empty mask the file is rw-rw-rw-, because touch (like editors and shell redirection) asks for 666, not 777. Executable files need chmod +x.

Change it for one command only

$ (umask 077; echo "token=abc" > token.txt)
> umask
> ls -l token.txt

output

0022
-rw------- 1 dev dev 10 Oct 31 20:21 token.txt

The subshell gets the strict mask and creates the file with it; the parent shell's umask is still 0022 afterwards.

Know that existing files are not affected

$ ls -l notes.txt
> umask 077
> ls -l notes.txt
> cp notes.txt copy.txt
> ls -l copy.txt

output

-rw-rw-r-- 1 dev dev 190 Oct 25 05:30 notes.txt
-rw-rw-r-- 1 dev dev 190 Oct 25 05:30 notes.txt
-rw------- 1 dev dev 190 Oct 31 20:21 copy.txt

notes.txt keeps its rw-rw-r-- after the umask changes. The copy is a new file, so the mask applies: cp asks for the source's mode and the umask strips the rest.

Set the mask in symbolic form

$ umask u=rwx,g=rx,o=
> umask; umask -S

output

0027
u=rwx,g=rx,o=

The symbolic form names the permissions to keep, which avoids octal arithmetic. This is the same as umask 027.

Print the umask as a reusable command

$ umask -p

explain

output

umask 0022

-p prints a umask command that would restore the current value, useful to save it and restore it later with eval.

Common pitfalls

Expecting umask 022 to make files 755. Files start from 666, so they get 644; only directories (and compilers that create binaries) ask for 777.
Computing the result by subtraction. The mask clears bits: umask 033 on a file request of 666 gives 644, not 633, because the execute bits it masks were never requested.
Setting umask in a script and expecting your terminal to keep it. It changes only the script's shell process and its children.
Relying on umask for files a program creates with explicit modes. Tools such as ssh-keygen and install -m set their own permissions; the umask can only take bits away from what they ask for.

GNU vs BSD and macOS

The examples above ran the GNU/Linux version. These are the differences that matter on macOS and the BSDs (written from their documentation, not run here).

umask and umask -S are POSIX and work the same in bash, zsh, dash and on macOS. -p is a bash extension.
The default comes from the login setup rather than from bash: typically UMASK in /etc/login.defs or a line in /etc/profile. Some distributions use 002 for regular users, since every user has a private group.

Options worth knowing

A selection, described in our own words. For the full list, see bash(1).

Option	What it does
`-S`	Show the mask in symbolic form (the permissions that remain).
`-p`	Print the mask as a umask command that can be reused as input.

Examples

Common pitfalls

GNU vs BSD and macOS

Options worth knowing

Related