umask calculator

How to use the umask calculator

Type a umask in the first box, or click one of the common values, and the calculator shows the mode that new files and new directories will get, both as an octal number and as the ls -l string. It also accepts the symbolic form that umask -S prints, such as u=rwx,g=rx,o=, and relative changes like go-w or g+w, which apply to the umask currently shown.

The second box works the other way round. Enter the permissions you want new directories (or new files) to have, for example 750 or rw-r-----, and the calculator gives you the umask that produces them. The commands at the bottom set that umask for the current shell, for every new bash shell, or for a systemd service.

Check your current value in a terminal:

umask
umask -S

Example output:

0002
u=rwx,g=rwx,o=rx

How umask works

When a program creates a file it asks the kernel for a mode, and the kernel removes every bit that is set in the umask. Most programs ask for 666 (rw-rw-rw-) for regular files and 777 (rwxrwxrwx) for directories. With the common umask 022, the write bit for group and others is removed, so new files end up as 644 and new directories as 755.

The operation is a bitwise "AND NOT", not subtraction. The difference shows up as soon as a umask digit contains the execute bit. With umask 033, subtracting would give 633 for files, which is wrong: files never had execute to begin with, so the real result is 644. The calculator does the bitwise version, which is what the kernel does.

The same umask therefore gives files and directories different modes, and a umask can never add a permission. In particular, no umask makes new files executable. Scripts you create still need chmod +x; see the chmod and chown cheat sheet for that and for fixing files that already exist.

Common umask values

Avoid umasks that remove the owner's own read or write bits, such as 277: the program that creates a file may fail to write to it. The calculator warns about these and about a umask of 000, which leaves new files writable by every user.

Setting the umask permanently

A umask command only affects the current shell and the programs it starts. To make it stick, set it where your sessions or services read it:

Many distributions use "user private groups": every user gets a group with the same name, and regular users then receive umask 002 while root keeps 022. That is safe because nobody else is in your personal group. Check what you actually get by opening a new terminal and running umask. Services do not read your shell files at all; systemd units start with umask 0022 unless they set UMask=, which is covered in the systemd basics guide.

Why a file did not get the mode you expected

• The program asked for less. The umask only removes bits from what the program requests. ssh-keygen writes private keys as 600, editors may copy the old file's mode, and mkdir -m 700 or install -m set explicit modes.
• Copies keep their mode. cp -p, rsync -a and tar -p (the default for root) restore the original permissions instead of using your umask.
• Default ACLs win. If the parent directory has a default ACL (setfacl -d), it replaces the umask for new entries in that directory. Check with getfacl dir.
• The umask belongs to the process. Changing it in one terminal does not affect another terminal, a desktop application started from the menu or an already running service.
• The filesystem ignores Unix modes. FAT, exFAT and NTFS mounts take their permissions from mount options such as umask=, fmask= and dmask= instead.

Existing files never change when you change the umask. Fix them with chmod, using the chmod calculator to pick the mode, and read the Linux file permissions guide for how owner, group and others interact. If a script you wrote will not run, the problem is a missing execute bit, covered in bash: Permission denied.

Frequently asked questions