Umask

umask is a mask to the default permissions that a file is written. Consider this if you write a file its default mode is 0666. This means anyone can delete it, write to it and read from it. If you had a umask of 077, the bits would be masked when you write the file. Here is the formula for determining the mode after umask is applied: mode &= ~(umask). Let's look at this in detail what does it mean? mode is mode (bitwise) AND unary inverse of umask (every bit set to 0 becomes 1 and vice versa). So 0666 AND 0700 is 0600, and that is what your final mode is. So a umask of 077 is very safe, noone but the user gets any permissions. What if you want to restrict only writing to a file created by group and others? It would be a umask of 022, so 0666 AND 0755 and you have 0644.