I'm trying to change umask mode using login.defs config file but for some reason it doesn't affect the system.

This is what I do: sudo nano /etc/login.defs

# The ERASECHAR and KILLCHAR are used only on System V machines.
# The ULIMIT is used only if the system supports it.
# (now it works with setrlimit too; ulimit is in 512-byte units)
# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
ERASECHAR       0177
KILLCHAR        025
UMASK           027

Trying to change UMASK 027 to UMASK 007 and it changes.


# Enable setting of the umask group bits to be the same as owner bits
# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
# the same as gid, and username is the same as the primary group name.
# This also enables userdel to remove user groups if no members exist.

Changing USERGROUPS_ENAB yes to USERGROUPS_ENAB no after that I save the file and do log out and log in and trying to create a file for example:

touch file ~/

and the output for file

stat -c %a ~/file

gives 644 and not expected 640. I remember I did this workaround some time ago and it worked perfectly fine.

Is there some other workaround or explanation?

This is my kernel information:

Linux 4.13.8-1-ARCH #1 SMP PREEMPT Wed Oct 18 12:11:48 CEST 2017 i686 GNU/Linux
  • Maybe the login.defs value is overwritten by a shell init file? (/etc/profile* /etc/bash.bashrc ~/.bashrc) Oct 25, 2017 at 22:28
  • Well in profile I find these lines: Set our umask / umask 022 ............ should I change them as well?
    – JoKeR
    Oct 25, 2017 at 22:36
  • I don't find anything unusual in bash.rc files none of them
    – JoKeR
    Oct 25, 2017 at 22:38
  • tried to change it in /etc/profile but same story.... As far as I remeber I didn't do any changes to either bash.rc or profile before
    – JoKeR
    Oct 25, 2017 at 22:53
  • /etc/login.defs it's where I'm trying to change it as stated in my OP
    – JoKeR
    Oct 25, 2017 at 23:07

1 Answer 1


Thanks for the comments who ever tried to help me. So I happened to make umask 027 mode permanent by changing ~/bashrc file. For a fact I didn't have any umask sets in that file, so I added these lines at the end of the text:

#umask mode
umask 027

And after system log out and log in it seems to overwrite this rule for entire system, now the newly created files have permission 640

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .