umask 002
Answer
With umask 002, new files are created 664 (rw-rw-r--) and new directories 775 (rwxrwxr-x). Your group can edit what you create; everyone else can only read it.
What umask 002 gives
- New files
664rw-rw-r--- New directories
775rwxrwxr-xumask -Su=rwx,g=rwx,o=rx
What to know
002 is meant for the user-private-group scheme, where every user has a primary group of their own containing only themselves. Group write is then harmless by default, and becomes useful in shared directories whose setgid bit (2775) hands new files to the team group.
On Debian and Ubuntu, /etc/login.defs sets UMASK 022 together with USERGROUPS_ENAB yes. For non-root users whose primary group is a personal group named after them, that setting copies the owner bits into the group bits, so 022 becomes 002 for their login sessions. Root keeps 022.
Gotchas
- If your primary group is a shared one (for example
usersorstaff), 002 makes every new file editable by that whole group. - Services and cron jobs do not inherit your login umask. A deploy script that must produce group-writable files should call
umask 002itself. - SSH and some tools check for group-writable files. With umask 002, a newly created
~/.ssh/configorauthorized_keysmay needchmod 600before it is accepted.
Related explainers
- umask 022umask 022 means new files are created 644 (rw-r--r--) and new directories 755 (rwxr-xr-x). How the umask...
- umask 077umask 077 creates files as 600 and directories as 700, so nothing you create is visible to other users....
- chmod 664 (rw-rw-r--)chmod 664 lets the owner and the file's group edit a file while others can only read it. Used for files in...
- chmod 775 (rwxrwxr-x)chmod 775 gives the owner and group full access and others read and execute. Used for shared directories;...
- chmod 2775: setgid directory (rwxrwsr-x)chmod 2775 makes a directory shared: files created in it inherit its group. How to set up a team directory...