umask, Special Bits, and Shared Directories

1. umask removes bits from a program’s requested mode

When a process creates an object, it supplies a requested mode. The kernel clears permission bits selected by the process umask. Conceptually:

\[\text{effective mode} = \text{requested mode} \;\&\; \sim\text{umask}\]

Many utilities request 0666 for regular files and 0777 for directories. Files do not receive execute merely because the umask permits it; the creating program normally does not request execute.

flowchart TD
  P["Program requests mode
file 0666 or dir 0777"] --> U["Process umask clears bits"]
  U --> A["Default ACL may adjust classes"]
  A --> O["Object created with final mode"]
  O --> V["stat / getfacl verification"]

# Display the current mask in numeric and symbolic form.
umask
umask -S

# Demonstrate in a subshell so the interactive shell is unchanged.
(
  umask 027
  mkdir -p demo-dir
  : > demo-file
  stat -c '%A %a %n' -- demo-dir demo-file
  rm -rf -- demo-dir demo-file
)

With umask 027, a requested directory mode of 777 becomes 750, while a requested file mode of 666 becomes 640.

2. umask belongs to a process and is inherited

The shell’s umask is inherited by child processes. A service manager, CI runner, login profile, container entrypoint, or application can establish a different mask. Changing your interactive shell does not retroactively modify existing objects.

3. Special bits add identity and directory semantics

Long listings replace an execute character with s/S for setuid or setgid and t/T for sticky. Lowercase means the corresponding execute bit is also set; uppercase means the special bit exists while execute is absent.

lab="$HOME/devops-academy/linux/chapter06/lesson04"
mkdir -p -- "$lab/setgid-dir" "$lab/sticky-dir"
chmod 2770 -- "$lab/setgid-dir"
chmod 1777 -- "$lab/sticky-dir"
stat -c '%A %a %n' -- "$lab/setgid-dir" "$lab/sticky-dir"

4. setgid directories stabilize collaborative group ownership

Without setgid, a newly created object normally receives the creator’s effective group, which may differ across team members. A setgid directory causes new entries to inherit the directory’s group. A cooperative umask such as 002 can then leave group write enabled.

shared="$HOME/devops-academy/linux/chapter06/lesson04/shared"
rm -rf -- "$shared"
mkdir -p -- "$shared"
chgrp -- "$(id -gn)" "$shared"
chmod 2770 -- "$shared"

(
  umask 002
  mkdir -- "$shared/release-a"
  printf 'owner=%s
' "$(id -un)" > "$shared/release-a/manifest.txt"
)

find "$shared" -maxdepth 2 -printf '%M %m %u:%g %p
' | LC_ALL=C sort

The setgid bit controls group inheritance; it does not automatically grant group write to new files. That depends on requested modes, umask, and default ACLs.

5. Sticky directories protect names in open shared spaces

A directory such as /tmp must allow many users to create files, but one user should not remove another user’s entries. The sticky bit adds this deletion/rename restriction. It does not encrypt files or prevent reading when file modes allow reading.

ls -ld -- /tmp
stat -c '%A %a %U:%G %n' -- /tmp

# A private lab example of the mode shape.
drop="$HOME/devops-academy/linux/chapter06/lesson04/dropbox"
mkdir -p -- "$drop"
chmod 1777 -- "$drop"
stat -c '%A %a %n' -- "$drop"

Testing multi-user sticky behavior requires at least two identities, so perform that experiment only in a disposable VM where creating test accounts is permitted.

6. Hands-on lab: compare private and collaborative defaults

set -eu
lab="$HOME/devops-academy/linux/chapter06/lesson04"
rm -rf -- "$lab/private" "$lab/shared-lab"
mkdir -p -- "$lab/private" "$lab/shared-lab"

# Private workspace: owner-only defaults.
(
  umask 077
  : > "$lab/private/secret.env"
  mkdir -- "$lab/private/cache"
)

# Shared workspace: inherited group and cooperative defaults.
chgrp -- "$(id -gn)" "$lab/shared-lab"
chmod 2770 -- "$lab/shared-lab"
(
  umask 002
  : > "$lab/shared-lab/release.txt"
  mkdir -- "$lab/shared-lab/artifacts"
)

{
  printf '=== shell mask ===
'
  umask
  printf '=== private ===
'
  find "$lab/private" -maxdepth 2 -printf '%M %m %u:%g %p
'
  printf '=== shared ===
'
  find "$lab/shared-lab" -maxdepth 2 -printf '%M %m %u:%g %p
'
} > "$lab/default-mode-report.txt"

cat -- "$lab/default-mode-report.txt"
test "$(stat -c %a -- "$lab/private/secret.env")" = 600
test "$(stat -c %a -- "$lab/shared-lab")" = 2770
test "$(stat -c %g -- "$lab/shared-lab/release.txt")" = "$(stat -c %g -- "$lab/shared-lab")"

7. Common default-mode and special-bit mistakes

8. Knowledge check

9. Summary

umask supplies process-scoped creation defaults by clearing requested bits. Setgid directories provide predictable group inheritance, sticky directories constrain deletion in open shared spaces, and setuid executables cross a sensitive identity boundary. Reliable designs combine scoped defaults, explicit modes, controlled special bits, and post-creation verification.

10. Further reading

• Linux man-pages: umask(2), inode(7), and credentials(7).
• GNU Coreutils manual for file permissions and special modes.
• Bash manual for the umask builtin.
• Filesystem and security documentation for setuid/setgid mount behavior.