When you create new files and directories, the initial permissions are controlled by your umask
setting. The application creating the item specifies the maximum permissions (typically rwxrwxrwx
for directories and executable files, rw-rw-rw-
for data files), and then the permissions in umask
are subtracted from this.
So if you want more restrictive permissions, you should set your umask
to remove the permissions you don't want to grant. The permissions you show come from having umask 002
, so it just disables other=write
. If you want to disable other=read/execute
as well, you should used:
umask 007
Traditionally, the default umask 002
comes from the assumption that all the users on a particular system would be a cooperating community (e.g. programmers in the same department of an organization), so there's little reason to prevent other users from reading your files in general. If you have specific files that are more private, you'd give them more restrictive permissions. If the above assumption is inappropriate for the users of your system, you should use a different default umask in the shell startup scripts.