ExamFinch.com My Study

Study guide

19.2 Manage Default File Permissions

Practice this exam

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

19.2 Manage Default File Permissions

Key Takeaways Explain This Topic AI

umask subtracts permission bits from default create modes: files typically start from 666, directories from 777, then umask is applied.

A common interactive umask is 0022 (files 644, directories 755); 0002 yields group-writable defaults (files 664, directories 775) useful for shared-group workflows.

Shell umask affects the current session and children; put umask in shell startup files for a user’s lasting interactive default.

System-wide defaults are influenced by /etc/profile, /etc/bashrc, and related snippets—and by login.defs UMASK for some account-creation paths; know where exam tasks want the change.

Verify with umask, umask -S, and by creating a test file and directory then reading ls -l modes—not by assuming theory alone.

Last updated: August 2026

19.2 Manage Default File Permissions

Quick Answer: umask controls the permission bits removed from default create modes. Defaults are typically file 666 and directory 777 before umask. Example: umask 022 → files 644 , directories 755 . Set for a session with umask 022 ; make user or system defaults persistent via shell startup files (and related system profiles). Verify by creating a file and directory and checking ls -l .

Official skill framing

Under Manage security , Red Hat expects you to manage default file permissions . Tasks sound like:

  • “Ensure newly created files are not group- or world-writable by default.”
  • “Set the default umask for user alice to 0077 .”
  • “Configure the system so new directories are 755 and new files are 644 for interactive users.”
  • “Use a umask appropriate for a collaborative group directory (often 0002 ).”

This is not the same as chmod on existing trees. chmod fixes current objects; umask shapes future creates in processes that inherit that umask.

How umask calculates modes

Unix create defaults (common model used in training):

  • Object Base before umask Meaning
  • Regular file 666 ( rw-rw-rw- ) No execute bit by default for plain files
  • Directory 777 ( rwxrwxrwx ) Execute/search bit available before masking

umask bits mark permissions to turn off .

Numeric examples

  • umask Files (approx) Directories (approx) Notes
  • 022 / 0022 644 rw-r--r-- 755 rwxr-xr-x Common “private file, public-read dir” default
  • 002 / 0002 664 rw-rw-r-- 775 rwxrwxr-x Group write kept—shared project dirs
  • 077 / 0077 600 rw------- 700 rwx------ Owner-only defaults
  • 027 640 750 Owner full; group read/execute; others none

Mental math (octal):

result ≈ base & ~umask

Example: file base 666 , umask 022 → clear write for group and other → 644 .

  • Directory base 777 , umask 022 → 755 . umask # show current (often 0022)
  • umask -S # symbolic form, e.g. u=rwx,g=rx,o=rx
  • Symbolic umask umask u=rwx,g=rx,o=rx # similar spirit to 022 for dirs
  • umask -S

On the exam, numeric three- or four-digit umask is most common in tasks and scripts.

  • Session umask (immediate) umask 022
  • touch /tmp/tfile
  • mkdir /tmp/tdir
  • ls -l /tmp/tfile
  • ls -ld /tmp/tdir

Expected with 022 : file mode 644 , directory 755 (plus any ACL/special bits if present—focus on rwx triad). umask 077

  • touch /tmp/secretf
  • mkdir /tmp/secretd
  • ls -l /tmp/secretf /tmp/secretd
  • # expect 600 and 700

Scope: umask built-in affects the current shell and processes it starts afterward. Other already-running daemons keep their own umask.

Per-user persistent umask

Interactive defaults usually come from shell startup files:

  • File Typical role
  • ~/.bashrc Bash interactive non-login nuances / common place for user umask
  • ~/.bash_profile or ~/.profile Login shell entry; may source bashrc
  • /etc/profile System-wide login shell startup
  • /etc/bashrc or /etc/bash.bashrc System bashrc patterns (distro layout)
  • Drop-ins under /etc/profile.d/*.sh Clean system-wide snippets

RHEL-style approach for one user : # As alice or editing alice's files as root:

  • echo 'umask 027' >> /home/alice/.bashrc
  • # ensure login path sources bashrc if required by the shell setup
  • Or for login shells explicitly in ~/.bash_profile : cat >> /home/alice/.bash_profile <<'EOF'
  • umask 027
  • EOF
  • chown alice:alice /home/alice/.bash_profile

After change, new login (or source the file) and re-test with touch / mkdir . su - alice -c 'umask; touch /tmp/alice_f; mkdir /tmp/alice_d; ls -l /tmp/alice_f; ls -ld /tmp/alice_d'

System-wide default umask

When the task says all users or system default :

Inspect existing settings: grep -R --line-number -E '^\s*umask' /etc/profile /etc/bashrc /etc/profile.d 2>/dev/null

grep -E '^UMASK' /etc/login.defs

Prefer a small snippet in /etc/profile.d/ for clarity (common admin pattern): sudo tee /etc/profile.d/local-umask.sh <<'EOF'

  • # Default umask for interactive shells system-wide
  • umask 022
  • EOF
  • sudo chmod 644 /etc/profile.d/local-umask.sh

/etc/login.defs UMASK value influences some account/create paths and is part of the traditional login defaults story: grep ^UMASK /etc/login.defs

# e.g. UMASK 022

On modern RHEL, shell startup files dominate interactive umask for users; still set login.defs if the task or local policy documentation points there. Read the task: “default umask for users” may mean profile.d/bashrc and/or UMASK in login.defs .

Do not randomly rewrite every package-owned file without understanding overrides—prefer profile.d drop-ins and user files the task names.

umask vs chmod vs ACL vs directory setgid

  • Tool Controls
  • umask Default bits for new files/dirs in that process
  • chmod Explicit mode on existing objects
  • Default ACL ( setfacl -d ) Default ACL entries for new objects in a directory
  • setgid on directory ( chmod g+s ) Group inheritance for new objects’ group owner

Shared project directories often combine:

  • Directory mode 2775 (setgid + group write)
  • umask 0002 so new files stay group-writable
  • Correct primary/supplementary group membership sudo mkdir -p /srv/project
  • sudo chgrp developers /srv/project
  • sudo chmod 2775 /srv/project
  • # users in developers with umask 002 create group-writable files

If umask is 022 , new files become 644 and group cannot write even in a group-writable directory—classic collaboration bug.

Special bits reminder

umask does not “invent” setuid/setgid/sticky on new ordinary files. Sticky/setgid on directories are set with chmod on the directory itself. Keep umask tasks focused on ugo rwx defaults unless the scenario also asks for special bits.

Daemons and service umask

Systemd services may set UMask= in unit files. Changing your shell umask does not change httpd or nginx create modes. For EX200 “default file permissions” wording, focus on user/system shell umask unless the task explicitly targets a service unit.

  • Verification checklist umask
  • umask -S
  • touch /tmp/umask_test_file
  • mkdir /tmp/umask_test_dir
  • stat -c '%a %n' /tmp/umask_test_file /tmp/umask_test_dir
  • ls -l /tmp/umask_test_file
  • ls -ld /tmp/umask_test_dir
  • For a named user: su - username -c 'umask; touch ~/f; mkdir ~/d; stat -c "%a %n" ~/f ~/d'

Confirm numeric modes match the policy implied by the required umask.

  • Exam workflows
  • Workflow A — Session umask for testing umask 022
  • touch /tmp/a; mkdir /tmp/b
  • stat -c '%a' /tmp/a /tmp/b # 644 and 755
  • Workflow B — Harden user alice to owner-only creates echo 'umask 077' | sudo tee -a /home/alice/.bashrc
  • sudo chown alice:alice /home/alice/.bashrc
  • su - alice -c 'umask; touch ~/x; mkdir ~/y; stat -c "%a" ~/x ~/y'
  • # expect 600 and 700
  • Workflow C — System-wide interactive umask 022 sudo tee /etc/profile.d/umask022.sh <<'EOF'
  • umask 022
  • EOF
  • sudo chmod 644 /etc/profile.d/umask022.sh
  • # new login shells pick this up
  • Workflow D — Collaboration-friendly umask 002 # For members of a shared project group
  • echo 'umask 002' >> ~/.bashrc
  • source ~/.bashrc
  • touch /srv/project/file1
  • ls -l /srv/project/file1 # expect group write if directory allows
  • Workflow E — Map required modes back to umask

If the task requires new files 640 and dirs 750 , work backward:

  • files 640 from 666 → umask clears 026 for files; dirs 750 from 777 → umask 027 . Use umask 027 . umask 027
  • touch /tmp/p; mkdir /tmp/q
  • stat -c '%a' /tmp/p /tmp/q
  • Common traps

chmod on one file when the task asked for default create permissions (umask).

Setting umask in a non-login shell file that never runs for the user’s login path—test with su - user .

Using umask 22 inconsistently vs 022 / 0022 —understand leading zeros; values are octal.

Expecting umask to change existing tree modes—only new creates.

umask 0002 vs shared dir without group write/setgid —still incomplete collaboration design.

Editing only /etc/login.defs and assuming every interactive bash session changed without checking profile scripts (or the reverse).

Forgetting directories use 777 base , so the same umask yields different numeric modes than files.

Setting a extreme umask like 077 and breaking multi-user app home contents without need.

Confusing umask with ACL masks or SELinux—the mode triad is only DAC.

Not verifying with a fresh touch/mkdir after configuration.

Relationship to other sections

Standard permissions (ugo/rwx): chmod / chown on existing objects; umask feeds new ones.

Users/groups: collaborative umask pairs with group membership.

SSH keys (19.3): ~/.ssh must often be 700 and keys 600 —set with chmod after create; umask alone may not enforce those paths if tools set modes explicitly, but a loose umask can create over-permissive files if you copy secrets carelessly.

Shell scripting: scripts may set umask near the top for predictable artifact modes.

Section checkpoint

You should explain how umask derives file vs directory modes, set session , per-user , and system-wide defaults appropriately, choose 022 , 002 , 027 , or 077 for the scenario, verify with umask and test creates, and distinguish umask from chmod on existing data. That satisfies EX200 management of default file permissions on RHEL 10.