So I know umask can restrict privileged users, using this format umask ugo.

I understand that the read = 4, write = 2, and exec = 1. However, when I type umask, it returns 4 digits which is 0022 or 0073. I have no understanding of how does this work now because there is an extra digit. What is that extra digit and what does 0022 mean?


1 Answer 1


Assume the default mask of 0666. umask 0022 would make the new mask 0644 (0666-0022=0644) meaning that group and others have read (no write or execute) permissions.

The "extra" digit (the first number = 0), specifies that there are no special modes.

If mode begins with a digit it will be interpreted as octal otherwise its meant to be symbolic.

0 is a digit, as is 1 (for the sticky bit) or 6 (for SGID). A command such as chmod can be called by other methods, such as chmod ug+rw mydir where you would add the read and write permissions to user and group. Note that the mode in this case (ug+rw) does not begin with a digit, thus would not be interpretted as octal but rather symbolic.

See en.wikipedia.org/wiki/Chmod#Symbolic_examples for symbolics as well as www.lifeaftercoffee.com/2007/03/20/special-permission-modes-in-linux-and-unix/ for a bit on special modes.

I don't know that you would unmask the first bit with umask, but technically you could. It would explain why you almost always see it as a zero.

Credit to pinkfloydx33

The first digit of the mask deals with special permissions that don't fit quite so cleanly into the owner/group/other model. When four digits are provided for a file permission, the first refers to those special values:

4000 = SUID
2000 = SGID
1000 = sticky bit

The SUID bit, short for set-user-ID, causes an executable program to run with the effective user id (uid) of the owner -- in other words, no matter who executes it, the program executes with the owner's rights. This is commonly seen in programs that do things that require root privileges, but are meant to be run by normal users: passwd is one such example.

The SGID bit, short for set-group-ID, is very similar, but runs with the effective group id (gid) of the owner.

The sticky bit is a little more complicated, if you want more information on that, you can read the manpage for sticky.

These bits can also be used with directories, but their meanings change.

I don't believe you can actually set the umask to allow you to enable any of these extra bits by default, but you probably would never want to do that anyways.

Credit to user470379

  • 3
    Actually, you can't supply a non-zero value other than in the last 3 digits. According to Posix: "The interpretation of mode values that specify file mode bits other than the file permission bits is unspecified." According to man 2 umask (the corresponding system call) "only the file permission bits of mask are used". In bash, umask 1000 generates an error: "octal number out of range". So why the extra 0? I think it's just to show that the number is in octal.
    – rici
    Jul 28, 2013 at 1:29
  • that pastebin has no reference whatsoever to umask, so I don't see how it's relevant. chmod does allow the first three bits to be set, but umask doesn't allow them to be masked. (i.e. you could have written chmod 6777 dropbox. And, by the way, also chmod ug+s.)
    – rici
    Jul 28, 2013 at 2:17
  • 3
    @Braiam: Your formula to calculate new mask is wrong, it's not 0666-0022, it's 0666 & ~0022.
    – cuonglm
    Dec 31, 2014 at 1:44
  • 3
    I think the objection is not the way the numbers are written, but the use of the subtraction operator (-) instead of bitwise and (&).
    – BowlOfRed
    Dec 31, 2014 at 3:11
  • 1
    The usage of - is confusing because the real calculation of the resulting permissions is neither arithmetic minus nor element wise minus (although it deceptively looks like it). For example 644 & (~022) = 644 and 666 & (~022) = 644. Or in binary: 110100100 = 110100100 & (~000010010) and 110100100 = 110110110 & (~000010010). Aug 1, 2016 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .