umask concept

umask concept :

When user create a file or directory under Linux or UNIX, she create it with a default set of permissions. In most case the system defaults may be open or relaxed for file sharing purpose. For example, if a text file has 666 permissions, it grants read and write permission to everyone. Similarly a directory with 777 permissions, grants read, write, and execute permission to everyone.

Default umask Value

The user file-creation mode mask (umask) is use to determine the file permission for newly created files. It can be used to control the default file permission for new files. It is a four-digit octal number. A umask can be set or expressed using:

* Symbolic values
* Octal values

Procedure To Setup Default umask :

# vi /etc/profile or $ vi ~/.bashrc

put : umask 022

The default umask 002 used for normal user. With this mask default directory permissions are 775 and default file permissions are 664.
The default umask for the root user is 022 result into default directory permissions are 755 and default file permissions are 644.

Symbolic umasks :

A umask set to u=rwx,g=rwx,o= will result in new files having the modes -rw-rw----, and new directories having the modes drwxrwx---, if the creating programs specify the typical modes.

Symbolic umask example

In bash:

$ umask u=rwx,g=rwx,o=
$ umask
0007
$ mkdir fu
$ touch bar
$ ls -l
drwxrwx--- 2 dave dave 512 Sep 1 20:59 fu
-rw-rw---- 1 dave dave 0 Sep 1 20:59 bar

Octal umasks :

Resultant permissions are calculated via the bitwise AND of the unary complement of the argument (using bitwise NOT) and the permissions specified by the program. Bash uses 666 for files, and 777 for directories. Remember that permission to execute a directory means being able to list it.

The octal notation for the permissions masked out are:

0 – none (i.e. all permissions specified are preserved)
1 – execute only
2 – write only
3 – write and execute
4 – read only
5 – read and execute
6 – read and write
7 – read, write and execute (i.e. no permissions are preserved)

A common umask value is 022 masking out the write permission for the group and others, which ensures that new files are only writable for the owner (i.e. the user who created them). In bash:

$ umask 0022
$ mkdir xdir
$ touch xfile
$ ls -l
drwxr-xr-x 2 dave dave 512 Aug 18 20:59 xdir
-rw-r--r-- 1 dave dave 0 Aug 18 20:59 xfile

Using the above mask, octal 0 doesn't prevent any user bits being set, octal 2 prevents write and execute group bits being set, and second octal 2 prevents the write and execute bit being set for others.

Another common value is 002, which leaves the write permission for the file's group enabled. This can be used for files in shared workspaces, where several users work with the same files.

Calculating resultant permissions example :
With the umask value of 0278 (intended to prohibit non group members from accessing files and directories) any new file will be created with the permissions 640 since:

6668 AND NOT(0278) = 6408 symbolically rw-r-----

and any new directory will have permissions 750 since:

7778 AND NOT(0278) = 7508 symbolically: rwxr-x---

Early UNIX systems were often used by relatively small groups of close colleagues who found it convenient to have most files read/write by everyone. PWB/UNIX evolved in a computer center environment to serve hundreds of users from different organizations. Its developers had combed through the commands to make key file creation modes more restrictive, especially for cases exposing security holes, but this was not a general solution. The addition of umask (around 1978) allowed sites, groups, and individuals to chose their own defaults. Small close groups might choose 000, computer centers 022, security-conscious groups 077 or 066 for access to sub-directories under private directories.
[edit]

---------------------

But, How Do I Calculate umasks?

The octal umasks are calculated via the bitwise AND of the unary complement of the argument using bitwise NOT. The octal notations are as follows:

* Octal value : Permission
* 0 : read, write and execute
* 1 : read and write
* 2 : read and execute
* 3 : read only
* 4 : write and execute
* 5 : write only
* 6 : execute only
* 7 : no permissions

Now, you can use above table to calculate file permission. For example, if umask is set to 077, the permission can be calculated as follows:

Bit Targeted at File permission
0 Owner read, write and execute
7 Group No permissions
7 Others No permissions

To set the umask 077 type the following command at shell prompt:
$ umask 077
$ mkdir dir1
$ touch file
$ ls -ld dir1 file

Sample outputs:

drwx------ 2 vivek vivek 4096 2011-03-04 02:05 dir1
-rw------- 1 vivek vivek 0 2011-03-04 02:05 file
------------------

Effective permission :

Octal numbers and permissions :

You can use octal number to represent mode/permission:

* r: 4
* w: 2
* x: 1

For example, for file owner you can use octal mode as follows. Read, write and execute (full) permission on a file in octal is
0+r+w+x = 0+4+2+1 = 7

Only Read and write permission on a file in octal is
0+r+w+x = 0+4+2+0 = 6

Only read and execute permission on a file in octal is
0+r+w+x = 0+4+0+1 = 5

Use above method to calculate permission for group and others. Let us say you wish to give full permission to owner, read & execute permission to group, and read only permission to others, then you need to calculate permission as follows:

User = r+w+x = 0+4+2+1 = 7
Group= r+w+x = 0+4+2+0 = 6
Others = r+w+x = 0+0+0+1 = 1

Effective permission is 761.

===================
Octal masking in more detail :

0022 = 0 0=- - - 2= - w- 2=- w-
rwx rwx rwx
421 421 421
U G O
masking out^^ ie removing that permission.

$ umask 0022
$ mkdir xdir
$ touch xfile
$ ls -l
drwxr-xr-x 2 dave dave 512 Aug 18 20:59 xdir
-rw-r--r-- 1 dave dave 0 Aug 18 20:59 xfile

Symbolic umask example is just like setting default value of dir/files(file shouldn't have x permission) :

$ umask u=rwx,g=rwx,o=
$ umask
0007
$ mkdir fu
$ touch bar
$ ls -l
drwxrwx--- 2 dave dave 512 Sep 1 20:59 fu
-rw-rw---- 1 dave dave 0 Sep 1 20:59 bar

Detailed explanation :

FILE : Here umask=0007 , bash & console use 666 for its file, uses 777 for dir. So file will get 660 as calculated it here.

Note : "Resultant permissions are calculated via the bitwise AND of the unary complement of the argument (using bitwise NOT) and the permissions specified by the program. Bash uses 666 for files, and 777 for directories. Remember that permission to execute a directory means being able to list it."

Example :

666 = 110 110 110
007= 000 000 111 (for NOT AND bit will be reverse and anding)
AND: 000 000 110 = 006
NOT_AND:110 110 000 = 660=rw-rw----
rwx rwx rwx

For DIR : Here umask=0007 , bash & console use 666 for its file, uses 777 for dir. So dir will get 770 as calculated it here.

777 = 111 111 111
007 = 000 000 111 (for NOT AND bit will be reverse and anding)
AND = 000 000 000 = 000
NOT_AND 111 111 000 = 770 = drwxrwx---
rwx rwx rwx

Testing :

$ umask u=rwx,g=rwx,o=
$ umask
0007
$ mkdir fu
$ touch bar
$ ls -l
drwxrwx--- 2 dave dave 512 Sep 1 20:59 fu
-rw-rw---- 1 dave dave 0 Sep 1 20:59 bar