L in u X ba sics for h acke rs g e t t I n g s t a r t e d w I t h

Setting More Secure Default Permissions with Masks
As you have seen, Linux automatically assigns base permissions—usually 
666
for files and 
777
for directories. You can change the default permissions 
allocated to files and directories created by each user with the 
umask
(or user 
file-creation mask) method. The 
umask
method represents the permissions 
you want to remove from the base permissions on a file or directory to make 
them more secure.
The 
umask
is a three-digit octal number corresponding to the three 
permissions digits, but the 
umask
number is subtracted from the permissions 
number to give the new permissions status. This means that when a new file 
or directory is created, its permissions are set to the default value minus the 
value in 
umask
, as shown in Figure 5-1.

---

Controlling File and Directory Permissions
57
Resulting permissions
umask
6 6 6
0 2 2
6 4 4
New files
−
7 7 7
0 2 2
7 5 5
New directories
−
Linux base permissions
Figure 5-1: How a umask value of 022 affects the permissions 
on new files and directories
For example, if the 
umask
is set to 
022
, a new file with the original default 
permissions of 
666
will now have the permissions 
644
, meaning the owner 
has both read and write permissions, and the group and all other users 
have only read permission.
In Kali, as with most Debian systems, the 
umask
is preconfigured to 022, 
meaning the Kali default is 644 for files and 755 for directories. 
The 
umask
value is not universal to all users on the system. Each user 
can set a personal default 
umask
value for the files and directories in their 
personal .profile file. To see the current value when logged on as the user, 
simply enter the command 
umask
and note what is returned. To change the 
umask
value for a user, edit the file /home/username/.profile and, for example, 
add 
umask 007
to set it so only the user and members of the user’s group have 
permissions.