a last-stage filter that strips away permissions as a file is created; each bit that is set to a "1" strips away that corresponding permission for the file. How the mask is applied Programmatically, the mask is applied by the OS by first negating (complementing) the mask, and then performing a logical AND with the requested file mode. In the [probably] first UNIX manual to describe its function, the manual says, Exceptions Many operating systems do not allow a file to be created with execute permissions. In these environments, newly created files will always have execute permission disabled for all users. The mask is generally only applied to functions that create a new file; however, there are exceptions. For example, when using UNIX and GNU versions of to set the permissions of a file, and symbolic notation is used, and no user is specified, then the mask is applied to the requested permissions before they are applied to the file. For example: $ umask 0000 $ chmod +rwx filename $ ls -l filename -rwxrwxrwx filename $ umask 0022 $ chmod +rwx filename $ ls -l filename -rwxr-xr-x filename Processes Each process has its own mask, which is applied whenever the process creates a new file. When a shell, or any other process, spawns a new process, the child process inherits the mask from its parent process. When the process is a shell, the mask is changed by the command. As with other processes, any process launched from the shell inherits that shell's mask. Mount option In the Linux kernel, the fat, hfs, hpfs, ntfs, and udf file system drivers support a umask mount option, which controls how the disk information is mapped to permissions. This is not the same as the per-process mask described above, although the permissions are calculated in a similar way. Some of these file system drivers also support separate masks for files and directories, using mount options such as fmask. See also File system permissions References Unix SUS2008 utilities IBM i Qshell commands File system permissions