umask
umask is a per-process mask on Unix that clears permission bits from newly created files and directories. The common 022 value yields 644 files and 755 directories; tighter sites use 027 or 077.
umask (user file-creation mode mask) is a per-process attribute on Unix-like systems that determines which permission bits are stripped from newly created files and directories. When a program calls `open()` or `mkdir()` with a requested mode, the kernel computes the final mode as `requested & ~umask` — bits set in the umask are removed. Typical base modes are 0666 for regular files (the kernel never grants execute on `creat`) and 0777 for directories. With the common umask of 022, new files end up at 0644 (rw-r--r--) and new directories at 0755 (rwxr-xr-x): readable by everyone, writable only by the owner. Tighter values include 027 (group readable, world denied) and 077 (private to the owner). A umask of 0 produces world-writable files, which is almost always a mistake. The value is inherited from the parent process across `fork`, so most users set it once in their shell startup (`~/.bashrc`, `~/.zshrc`, or `/etc/profile`). System services may set their own umask in unit files or init scripts. PAM's `pam_umask` module can apply a per-login default. Inside a shell, `umask` with no argument prints the current value; `umask 027` sets it; `umask -S` shows the symbolic form. umask interacts with POSIX ACLs in a subtle way: when a directory has a default ACL, the new file's permissions are derived from the ACL rather than from the parent process's umask. Container images, cron-driven scripts, and CI pipelines often inherit a surprising umask from their launcher, so files created during builds can end up with unexpected modes — a frequent source of 'works on my machine' permission bugs.