umask: control default permissions for new files

Every time a program creates a file, the umask decides which permissions it does not get. Getting it right means new files are private or shared exactly as you intend, without running chmod after every upload. This guide explains how umask works and how to set it for shells, services and SFTP.

Before you start

• A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
• An SSH session, with sudo for system-wide changes.
• Basic knowledge of numeric permissions such as 644 and 755. See Linux file permissions explained.

How umask works

Programs ask for a starting mode when they create something. Most ask for:

• 666 (rw-rw-rw-) for files.
• 777 (rwxrwxrwx) for directories.

The umask lists the bits to remove from that request. With the common umask 022:

• Files: 666 minus write for group and others = 644.
• Directories: 777 minus write for group and others = 755.

With 002, only others lose write access, so files become 664 and folders 775. With 077, group and others lose everything: files 600, folders 700.

Check the current umask

umask
umask -S

0022
u=rwx,g=rx,o=rx

The first form is numeric. The -S form shows what is allowed, which is easier to read. Test it by creating a file and folder:

touch test.txt && mkdir testdir && ls -ld test.txt testdir

022 vs 002: which to use

• 022: only the owner can change new files. Good default for servers and single-admin setups.
• 002: the group can change new files too. Useful when several users share a folder through a common group.
• 027 or 077: nothing for others, or nothing for anyone but the owner. Good for accounts that handle secrets.

On Ubuntu, Debian, AlmaLinux and Rocky, normal users have a private group with the same name as the user, so a 002 umask is less risky than it sounds: the group is usually just the user.

Set the umask for your shell

For the current session only:

umask 027

To make it permanent for one user, add the line to ~/.bashrc (or ~/.profile, which runs at login):

echo 'umask 027' >> ~/.bashrc

Log out and back in, then run umask to check.

Set the default for all users

The system default comes from the UMASK line in /etc/login.defs, applied by PAM at login:

grep -E '^UMASK|^USERGROUPS_ENAB' /etc/login.defs

When USERGROUPS_ENAB is yes, users whose private group matches their name get a group-write variant of that umask automatically. Change system defaults with care, and test with a new login before closing your session.

Set the umask for a systemd service

Services do not read .bashrc. Set the umask in the unit with UMask=. Use a drop-in so package updates do not overwrite it:

sudo systemctl edit myapp.service

Add:

[Service]
UMask=0027

Save, then restart the service:

sudo systemctl restart myapp.service

Files the service creates from now on will be 640 and folders 750. The default for services is 0022. The drop-in method is covered in more depth in Override a systemd unit with a drop-in.

Set the umask for SFTP uploads

SFTP uploads usually keep the permissions of the source file or use the server's umask. To force a value, pass -u to the SFTP server in /etc/ssh/sshd_config. For all users, change the Subsystem line:

Subsystem sftp internal-sftp -u 0002

Or set it only for a group inside a Match block:

Match Group webteam
    ForceCommand internal-sftp -u 0002

Test the config and reload SSH:

sudo sshd -t
sudo systemctl reload ssh

Use sshd instead of ssh on AlmaLinux and Rocky.

Some clients, such as WinSCP, can also set permissions on upload. Check the client's transfer settings if files still arrive with unexpected modes.

Check it works

As the user or in the service you changed, create a file and check its mode:

touch /tmp/umask-test && stat -c '%a %n' /tmp/umask-test

With umask 027, the result is 640 /tmp/umask-test. For a service, look at a file it created recently with stat. Delete the test files when you are done.

Troubleshooting

• umask resets after logout: you set it only in the session. Add it to ~/.bashrc or ~/.profile.
• Service still creates 644 files: you edited .bashrc, which services ignore. Use UMask= in the unit and restart the service.
• Files in a shared folder are not group-writable: the creator's umask is 022. Set 002 for those users and the setgid bit on the folder.
• An app sets its own modes: some apps call chmod themselves or have a permission setting. umask cannot override that; change the app's config.

Next steps

• Put a shared group folder together: Create a shared folder several users can edit.