PAM_UMASK(8)

💖 PAM_UMASK(8) 💖

okay bestie, welcome to the Linux-PAM Manual entry for pam_umask — yes that's the whole manual name, we're fancy here ✨

---

🌸 NAME 🌸

pam_umask — a PAM module that sets the file mode creation mask. that's it, that's the girl 💅

---

🦋 SYNOPSIS 🦋

pam_umask.so [debug] [silent] [usergroups] [nousergroups] [umask=mask]

---

✨ DESCRIPTION ✨

so pam_umask is a PAM module whose whole personality is setting the file mode creation mask of the current environment. and why do we care?? because the umask literally decides the default permissions that get handed to every newly created file. main character behavior fr fr 👑

now here's the part where it gets detective-y. the module goes looking for the umask value in these places, in this exact order:

• a umask= entry in the user's GECOS field (more on that in a sec, bestie, don't worry)
• the umask= argument
• the UMASK entry from /etc/login.defs
• the UMASK= entry from /etc/default/login

so like. it checks them in that order and that's the vibe check that matters. 📋

now, about that GECOS field — it gets split on comma ',' characters, and your entries have to live in its 'other' (sub-)field, which is the 5th field within the GECOS field. you could set that, for example, with chfn --other. and listen, besides the umask= entry, this module also recognizes two more little icons:

• the pri= entry, which sets the nice priority value for the session
• the ulimit= entry, which sets the maximum size of files the processes in the session can create

the way it just knows three things at once?? obsessed 😭

---

🎀 OPTIONS 🎀

• debug — print debug information. little peek behind the curtain, we love to see it 🔍
• silent — don't print informative messages. she's quiet, she's mysterious, she's giving less-is-more 🫶
• usergroups — if the user is not root and the username is the same as the primary group name, then the umask group bits get set to be the same as the owner bits. examples so you get it: 022 -> 002, 077 -> 007 ✨
• nousergroups — literally the direct opposite of the usergroups option above ☝️ which is useful when pam_umask was compiled with usergroups enabled by default and you wanna turn it off at runtime. no cap, sometimes you just need the off switch.
• umask=mask — sets the calling process's file mode creation mask (umask) to mask & 0777. and the value is interpreted as Octal, so don't come at it with decimal, she will not be doing that 🚫

---

👑 MODULE TYPES PROVIDED 👑

only the session type is provided. one type, one vibe, absolutely slaying it. 💅

---

💜 RETURN VALUES 💜

• PAM_SUCCESS — the new umask was set successfully. we ate and left no crumbs 🔥
• PAM_BUF_ERR — memory buffer error 😭
• PAM_CONV_ERR — the conversation method supplied by the application failed to obtain the username. rude of it tbh
• PAM_INCOMPLETE — the conversation method supplied by the application returned PAM_CONV_AGAIN. it's giving "not yet bestie"
• PAM_SERVICE_ERR — no username was given. 💀
• PAM_USER_UNKNOWN — user not known. who is she?? nobody knows her 🙈

---

🌈 EXAMPLES 🌈

wanna set the user specific umask at login? add this exact line to /etc/pam.d/login and watch the magic happen:

            session optional pam_umask.so umask=0022

---

🌟 SEE ALSO 🌟

pam.conf(5), pam.d(5), pam(8) — go read your sisters, bestie, iykyk 📚

---

🍓 AUTHOR 🍓

pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>. thank you for your service king 🫡

---

and that's the whole page!! Linux-PAM, 09/27/2026 — periodt, go set your umask responsibly babes 💖✨🎀🦋🌸