INTRODUCTION
Umask is a C-shell builtin command which allows you to
determine or specify the default access (protection)
mode for new files you create. (See the general help
file on "unix/access protection 1 - chmod" for more
information on access modes and how to change modes for
existing files.) You may issue the umask command
interactively at the command prompt to affect files
created during the current session. More often, the
umask command is placed in the .cshrc file to be
executed automatically whenever a new C-shell is
started, ensuring that the default is the same for each
session.
SYNTAX FOR THE UMASK COMMAND
The syntax for the umask command is
umask [ value ]
where "value" is an octal number of up to three digits.
If "value" is not specified, the umask command returns
the current umask value. If an octal number shorter
than three digits is specified, it is assumed to be
padded with leading zeros; e.g., "77" is equivalent to
"077". The scheme for determining what octal number
produces which access mode (described below) is
somewhat involved; however, the list of common access
modes given below can probably help you avoid having to
learn the scheme.
UMASK SETTINGS FOR COMMON ACCESS MODES
The following examples show the effect on files and
directories created under various umask values. In
each of the two lists, values are listed in decreasing
order of security. Unless you have a particular reason
to allow others access to your files, the "077" umask
is recommended to provide reasonable protection for
your files. Placing the line
umask 077
in your .cshrc will cause all new files and directories
to be created without access for group and others.
In the following examples, "user" refers to the creator or owner of the file or directory, "group" to the group associated with the file (you can determine this by using "ls -lg"), and "others" to anyone who is not the "user" or in the "group".
Value Mode Effect on FILES Created Under Value
077 -rw------- user can read and write file; no access
for group or others
027 -rw-r----- user can read and write file; group can
read; no access for others
007 -rw-rw---- user can read and write file; group can
do the same; no access for others
022 -rw-r--r-- user can read and write file; group can
read; others can read
002 -rw-rw-r-- user can read and write file; group can
read and write; others can read
Value Mode Effect on DIRECTORIES Created Under Value
077 drwx------ user can read, write, list names of
files in the directory, and delete
files from the directory; no access
for group or others
027 drwxr-x--- user can read, write, list names of
files in the directory, and delete
files from the directory; group can
read and list names of files; no
access for others
007 drwxrwx--- user can read, write, list names of
files in the directory, and delete
files from the directory; group can
do the same as the user; no access
for others
022 drwxr-xr-x user can read, write, list names of
files in the directory, and delete
files from the directory; group can
read and list names of files; others
can read and list names of files
002 drwxrwxr-x user can read, write, list names of
files in the directory, and delete
files from the directory; group can
do the same as the user; others can
read and list names of files
HOW TO DETERMINE THE ACCESS MODE PRODUCED BY A GIVEN OCTAL VALUE
If you found your favorite in the list of common values
above, you may want to skip the following explanation
and proceed directly to the section on references. If
not, read on.
The three-digit octal value returned by or specified for umask is a file creation mask. The first digit is associated with the user (creator of the file), the second with the group, and the third with others. This mask is XORed (eXclusive ORed) with the access mode 666 for files or 777 for directories to determine the access mode for newly created files and directories. The "execute" permission is associated with the value "1", the "write" permission with "2", and the "read" permission with "4". These permission values are added together to create each octal digit. Since the mask is XORed with the octal number 666 or 777, which represent full permissions for user, group, and others (each digit in that order), the result is the opposite of what is represented by the mask; that is, the umask value specifies those access modes which are to be DENIED. For example, XORing the umask value of 077 (7=1+2+4: DENY no permissions for the user, DENY all permissions for the group and others) with 666 or 777 results in files and directories being created with the access mode: all permissions for the user and none for the group or others.
REFERENCES
For further information, see the general help file on
"unix/access protection 1 - chmod". Also see the
online manual pages for umask, chmod, and ls.