Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why is umask a $perms AND NOT $mask and not simply $perms AND $mask instead?

In other words why is there a NOT in there; why doesn't wasn't it implemented as an and mask?

As an example, 666 and 700, to give 600?

share|improve this question
up vote 4 down vote accepted

The key is that the umask ("user mask") is intended to keep processes from creating files with permission bits they're not supposed to use. If you look at it from that perspective, the concept of a umask may make more sense; in particular, the common umask of 022 prevents processes from creating files that are writable by group or world, which is usually what you want.

share|improve this answer
This misses the point of the question. Why is it 022 and not 0755? – Ignacio Vazquez-Abrams Jul 3 '11 at 0:46
No, he nailed it. You want to clear permissions bits, not set them. – Jodie C Jul 3 '11 at 1:30
Jodie, I think you missed what the OP is demonstrating in his example. He is asking why the mask isn't a representation of what a process is allowed to set (i.e. an 0755 mask would mean that, at most, a process could set group/world read and execute). It's really a question of a design decision made 50 years ago. – Kyle Smith Jul 3 '11 at 3:26
I know exactly what he's saying. His example isn't very good. Try an AND with a 6 and 5. It's 4! Try doing that in your head. Now do 6 NOT AND 2... well that's easy, 6-2 = 4. Easier on the operator to set the bits to be cleared. – Jodie C Jul 3 '11 at 4:54
I think I see, therefore the way it works was entirely a conceptual decision - to mark permissions that aren't allowed rather than mark permissions that are allowed. I always considered it confusing and the wrong way around. – Spacen Jasset Jul 3 '11 at 9:31

The input value is octal which may require a leading 0 to be parsed correctly. As the owner mask is almost always 0 the mask can be entered with three digits. As an AND mask, it would need to be entered as 0755 or 0750.

Defining it as an AND NOT operation makes it safer if characters are missed in the mask. If umask was and AND operation umask 5 would allow only limited world access and umask 0 would be even worse. umasq 75 parsed as a decimal value would be be effectively umask 113 which would not allow read acces.

EDIT: From another perspective, the mask is a list of the bits you want masked off. Therefore you want masks like 026 rather than 0751. Internal representation may well be 07751 or what ever is appropriate for ANDing. If not, the conversion is relatively trivial, and in the grand scheme of things the mask doesn't get applied that often.

share|improve this answer
How is this any different than umask(22)? (bash's umask assumes the number is octal if it starts with a digit) – Ignacio Vazquez-Abrams Jul 3 '11 at 4:12
@Ignacio A decimal umask(22)`` is treated as umask 026`leaves the owner with full access to the file and is roughly what was intended. – BillThor Jul 4 '11 at 3:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.