Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So I know umask can restrict privileged users, using this format umask ugo.

I understand that the read = 4, write = 2, and exec = 1. However, when I type umask, it returns 4 digits which is 0022 or 0073. I have no understanding of how does this work now because there is an extra digit. What is that extra digit and what does 0022 mean?

share|improve this question
Braiam, questions can be migrated automatically. You do not need to open a new question here because one exists on SO. FWIW, there is also an extensive answer about umask on Ask Ubuntu. –  Lekensteyn Jul 28 '13 at 14:37
@Lekensteyn Please read the small letter :D. Question cannot be migrated from SO because is too old, but it's still off-topic there. And it's a shame that a canonical question/answer is over Ask Ubuntu instead here :/. –  Braiam Jul 28 '13 at 14:51
I don't think it is a big deal to have questions at other Q&A sites. Both SO and AU are not going to vanish soon. And to be honest, if you don't find something using the SE search box, you'll type it in at Google which will redirect you to one of the SO sites anyway. –  Lekensteyn Jul 28 '13 at 18:54

1 Answer 1

up vote 5 down vote accepted

Assume the default mask of 0666. umask 0022 would make the new mask 0644 (0666-0022=0644) meaning that group and others have read (no write or execute) permissions.

The "extra" digit (the first number = 0), specifies that there are no special modes.

If mode begins with a digit it will be interpreted as octal otherwise its meant to be symbolic.

0 is a digit, as is 1 (for the sticky bit) or 6 (for SGID). A command such as chmod can be called by other methods, such as chmod ug+rw mydir where you would add the read and write permissions to user and group. Note that the mode in this case (ug+rw) does not begin with a digit, thus would not be interpretted as octal but rather symbolic.

See en.wikipedia.org/wiki/Chmod#Symbolic_examples for symbolics as well as www.lifeaftercoffee.com/2007/03/20/special-permission-modes-in-linux-and-unix/ for a bit on special modes.

I don't know that you would unmask the first bit with umask, but technically you could. It would explain why you almost always see it as a zero.

Credit to pinkfloydx33

The first digit of the mask deals with special permissions that don't fit quite so cleanly into the owner/group/other model. When four digits are provided for a file permission, the first refers to those special values:

4000 = SUID
2000 = SGID
1000 = sticky bit

The SUID bit, short for set-user-ID, causes an executable program to run with the effective user id (uid) of the owner -- in other words, no matter who executes it, the program executes with the owner's rights. This is commonly seen in programs that do things that require root privileges, but are meant to be run by normal users: passwd is one such example.

The SGID bit, short for set-group-ID, is very similar, but runs with the effective group id (gid) of the owner.

The sticky bit is a little more complicated, if you want more information on that, you can read the manpage for sticky.

These bits can also be used with directories, but their meanings change.

I don't believe you can actually set the umask to allow you to enable any of these extra bits by default, but you probably would never want to do that anyways.

Credit to user470379

share|improve this answer
Actually, you can't supply a non-zero value other than in the last 3 digits. According to Posix: "The interpretation of mode values that specify file mode bits other than the file permission bits is unspecified." According to man 2 umask (the corresponding system call) "only the file permission bits of mask are used". In bash, umask 1000 generates an error: "octal number out of range". So why the extra 0? I think it's just to show that the number is in octal. –  rici Jul 28 '13 at 1:29
that pastebin has no reference whatsoever to umask, so I don't see how it's relevant. chmod does allow the first three bits to be set, but umask doesn't allow them to be masked. (i.e. you could have written chmod 6777 dropbox. And, by the way, also chmod ug+s.) –  rici Jul 28 '13 at 2:17
Yeah, you are right, don't know what was I thinking. –  Braiam Jul 28 '13 at 13:11
@Braiam: Your formula to calculate new mask is wrong, it's not 0666-0022, it's 0666 & ~0022. –  cuonglm Dec 31 '14 at 1:44
@cuonglm where? –  Braiam Dec 31 '14 at 2:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.