umask and the special bits: SUID, SGID and sticky

Where do new files get their permissions?

When a program creates a file, it asks for 666 (rw-rw-rw-) and for a directory 777 (rwxrwxrwx). The umask (user file-creation mask) then takes away bits. Each 1 bit in the umask removes that permission. The result is the requested mode AND NOT umask; for simple cases you can just subtract digit by digit.

$ umask
0002
$ umask 027
$ touch a.txt; mkdir d
$ ls -ld a.txt d
-rw-r-----. 1 asha asha 0 Oct 19 12:10 a.txt
drwxr-x---. 2 asha asha 6 Oct 19 12:10 d

Files never get execute from the umask alone, because the start value 666 has no x. That is a safety feature: a downloaded file cannot run until someone adds x.

On a typical RHEL 9 system, root's umask is 0022 and normal users with a private group get 0002. To change it for good, set it in a shell start-up file such as ~/.bashrc for one user, or in a file under /etc/profile.d/ for everyone.

The special bits

A fourth, leading octal digit holds three special bits: SUID = 4, SGID = 2, sticky = 1. In ls -l they replace the x in one of the sets.

$ ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 32648 Aug 10  2021 /usr/bin/passwd
$ ls -ld /tmp
drwxrwxrwt. 18 root root 4096 Oct 19 12:00 /tmp
# chmod 2770 /srv/team         # SGID + rwxrwx---
# chmod g+s /srv/team          # the same SGID, with letters
# chmod 1777 /srv/dropbox      # sticky, like /tmp
# chmod u+s /usr/local/bin/tool   # SUID (be very careful)

A capital S or T (for example rwSr--r--) means the special bit is set but the execute bit under it is not, which is usually a mistake.

Why SGID directories matter for teams

Without SGID, a file that asha creates in /srv/team gets her primary group, asha, so the rest of the team cannot edit it. With SGID on /srv/team (group team), every new file gets the group team automatically. Combined with umask 0002 (group can write), the whole team can work on each other's files.

Common mistakes

• chmod 770 /srv/team after setting SGID: on many systems a plain three-digit chmod on a directory keeps the SGID bit, but do not rely on that; use 2770 to be explicit.
• Thinking umask is a permission. It is a mask of bits to REMOVE.
• Setting the sticky bit on a file and expecting something to happen. On Linux it only matters on directories.