umask — Default Permissions

Why is a new file -rw-r--r-- (644) and a new folder drwxr-xr-x (755)? Because of the umask.

umask              # 0022
umask -S           # u=rwx,g=rx,o=rx — what new files may get

How it works

New files start from 666 (read and write for everyone), folders from 777. The umask names the bits to take away:

	Start	umask 022	Result
File	666 `rw-rw-rw-`	− `----w--w-`	644 `rw-r--r--`
Folder	777 `rwxrwxrwx`	− `----w--w-`	755 `rwxr-xr-x`

022 = nobody but you may write. Execute is never given to files by default — that's always a chmod +x.

umask 077          # only I can read and write what I make
touch draft.txt
mkdir private-dir
ls -ld draft.txt private-dir

-rw------- 1 student student    0 Oct 30 10:00 draft.txt
drwx------ 2 student student 4096 Oct 30 10:00 private-dir

umask	Files	Folders	Use
`022`	644	755	the usual: others may read
`002`	664	775	a group works on the same files
`077`	600	700	private: keys, backups, secrets

The umask only changes what new files get — files that already exist keep their permissions (that's what chmod is for).

It belongs to the shell it's set in. For a few commands, set it in a subshell ( … ) — it ends with them:

(umask 077; echo "token=abc123" > secret.txt)
ls -l secret.txt   # -rw-------
umask              # still 0022

For good: put umask 077 in ~/.bashrc.

💡 A script that writes passwords or keys should set umask 077 at the top — then there's no moment when the file is readable by others.