I've read a couple of articles like this old one how to change umask mode but still can't figure it out 100% I have Ubuntu 14.04 running with Xenial kernel with default umask 0002 and my aim is to set 0027 umask mode permanently all across the system. How do I make it happen? What be the best way to do so?

3 Answers 3


A simple man -k umask should have led you to reading man pam_umask, whish says, in part:

pam_umask is a PAM module to set the file mode creation mask of the
current environment. The umask affects the default permissions assigned
to newly created files. 

It also says,

The PAM module tries to get the umask value from the following places
   in the following order:

   ·   umask= argument

   ·   umask= entry in the user's GECOS field

   ·   UMASK= entry from /etc/default/login

   ·   UMASK entry from /etc/login.defs (influenced by USERGROUPS_ENAB in
  • in /etc/login.defs I found two lines like: Login configuration initializations UMASK Default "umask" value. and further UMASK 022 what should I change over here? looks like I've tried to put myself 022 but still when I run in terminal umask it says 0002
    – JoKeR
    Aug 1, 2016 at 23:31
  • here's one thing I got now after I change that 022 value to 027 and when I run umask in terminal now I get umask 0007 so how do I get 0027? I tried to put 047 but it's still gets me 0007
    – JoKeR
    Aug 1, 2016 at 23:46

Thanks @waltinator for pointing me for the right direction.

From here I figured easy step how to set umask mode to 0027 just run in terminal:

sudo gedit /etc/login.defs

or with nano which one you prefer.

search for the line:

Prefix these values with "0" to get octal, "0x" to get hexadecimal.

UMASK       027

Edit the last line refering UMASK this will set umask to 0007 to take effect simply log out and log in back.

Make a notice on the lines above: If USERGROUPS_ENAB is set to "yes", that will modify this UMASK default value...used as group permissions, e. g. 022 will become 002

So for the umask 0027 to take effect roll down to the line:


and change it to:


Done. After you logged out and log in back run in terminal umask and it'll give you 0027 mode.

Now create a new file with touch in terminal:

touch testfile

now check the permissions:

stat -c %a ~/testfile

It should give you 640


There's another simple way:

nano ~/.bashrc


#Set umask mode
umask 0027

Close and save, logout and login. Should work for you as well.

  • It worked perfectly for me until later there was another bug with dbus in Ubuntu after 17.04. Please read bugs.launchpad.net/ubuntu/+source/gnome-terminal/+bug/1685754/…
    – fchen
    Jan 19, 2019 at 17:12
  • The ~/.bashrc variant does not work for me (Ubuntu 20.04.1).
    – Gustave
    Jan 25, 2021 at 8:59
  • The login.defs variant does not work for me neither (login via ssh).
    – Gustave
    Jan 25, 2021 at 9:10
  • With the simple method you have to run bash at least once to change umask, otherwise new files created via GUI will have different default permissions than you expect. The USERGROUPS_ENAB variable set to yes is convenient because thanks to it, when executing the deluser command, the group with the same gid as the user uid and the same name as the user is also deleted (if the group has no other members), without having to do it later. Jul 29, 2022 at 10:03
  • 1
    @MarioPalumbo Are you saying that if you want to change the umask to 0022 the only thing you need to do is comment out the #UMASK 022 line and nothing else? Aug 30, 2022 at 2:39

I was using JoKeR's answer above to achieve a system wide umask of 027 but I was conscious that when I used USERGROUPS_ENAB no it required more group management. So I feel I have found a better answer, basically:

  1. Make sure that the pam-modules package is installed; that makes the pam_umask module available.
  2. Make sure that /etc/pam.d/common-session has a line of the form
    session optional pam_umask.so
    so that pam_umask is enabled.
  3. According to the pam_umask man page, the default umask is determined at login by checking each of the following places, in order:
    • A hard system-wide default set in /etc/pam.d/common-session. To set it this way, replace the line from that file mentioned above with this:
      session optional pam_umask.so umask=027
    • An entry in an individual user's GECOS field in /etc/passwd overrides a soft system-wide default for that specific user. Create that entry using a command of the form:
      chfn --other='umask=027' username
    • A line of the form UMASK=027 in /etc/default/login (you may need to create that file) sets a soft system-wide default.
    • The UMASK value from /etc/login.defs. That value is also used for something else (computing the permissions on the home directory of a new user that is being created; see the comments in /etc/login.defs for more details). So it is best to avoid relying on this for setting the default umask for regular logins, to keep things separate.

So now for me I use the first option (system-wide default set in /etc/pam.d/common-session) and it's working really well.

Good luck my friends :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.