Set a Default umask on macOS Correctly

Per-shell umask works in one terminal; the supported system-wide route is launchctl config user umask.

macOSumaskpermissionsMedium risk

Run `umask 027` for the current shell, or `sudo launchctl config user umask 027` and reboot to change it system-wide.

01Command

Command

$ # Per-shell:
umask 027
# System-wide (launchd macOS 10.11+):
sudo launchctl config user umask 027

02What it does

On macOS the classic `/etc/profile` or PAM edits many Linux guides suggest do not affect apps launched by launchd, Finder, or Spotlight. Apple's supported method is `sudo launchctl config user umask <mask>`, which writes `/var/db/com.apple.xpc.launchd/config/user.plist` and applies at next boot. `umask 027` yields files readable by owner and group but not others — a common requirement on shared machines. `umask` alone prints the current octal value.

03Risk

RiskMedium risk

RequirementsSudo for the system-wide launchctl variant

!Warning: A system-wide umask change affects every GUI app after reboot; 077 in particular breaks some apps that share files across users.

04Undo

Undo

$ sudo launchctl config user umask 022

05Sources

umask — macOS Command Reference
SS64 · technical · 2026-09-17
Evidence: Documents the octal mask semantics and current value display.
Set a default umask on macOS
Apple Support · vendor-doc · 2026-09-17
Evidence: Documents launchctl config user umask as the supported system-wide method.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

View macOS File ACLs with ls -le

macOSchmodsharingpermissions

See the extended ACL entries and file flags that plain ls -l and Unix chmod know nothing about.

Low risk ✓ 2026-09-17