Simple definition
umask defines which permission bits are removed by default when new files and directories are created on Unix/Linux systems.
Technical definition
An application requests a creation mode, commonly based on 0666 for files and 0777 for directories. The kernel then applies the mask: bits present in the umask are removed from the requested mode. The umask is inherited by child processes.
How it works / role
With umask 027, a directory requested as 0777 normally becomes 0750, while a file requested as 0666 becomes 0640. umask does not replace chmod: it affects initial permissions, not permissions on an object that already exists.
What is it used for?
Prevent newly created files or directories from receiving overly permissive access rights.
Practical example
A service started with umask 027 creates configuration files readable by the owner and group but not by other users.
Common issues
- Mask is too permissive and exposes data
- Mask is too restrictive and breaks an application
- Different umask between an interactive shell and a system service
- Confusion between umask, chmod, and ACLs
Related terms
Key takeaway: umask acts at creation time by removing permission bits; it does not retroactively change existing files.