service unit '{name}' has invalid `umask` value '{umask}'; e

Error message

service unit '{name}' has invalid `umask` value '{umask}'; expected an octal access mask from 0000 through 0777

What it means

The optional `umask` for a service unit must be a valid octal access mask from 0000 through 0777; `valid_umask` enforces this at parse time. Invalid values (non-octal digits, out-of-range, wrong format) are rejected before the unit file is generated.

Source

Thrown at src/system/systemd.rs:226

                && config.on_unit_active_sec.is_none()
                && config.on_unit_inactive_sec.is_none()
                && config.on_calendar.is_none()
            {
                bail!(
                    "timer unit '{name}' must set at least one of `on_boot_sec`, \
                     `on_unit_active_sec`, `on_unit_inactive_sec`, or `on_calendar`"
                );
            }
        }
        if let Some(nice) = config.nice
            && !(-20..=19).contains(&nice)
        {
            bail!("service unit '{name}' has invalid `nice` value {nice}; expected -20 through 19");
        }
        if let Some(umask) = &config.umask
            && !valid_umask(umask)
        {
            bail!(
                "service unit '{name}' has invalid `umask` value '{umask}'; expected an octal access mask from 0000 through 0777"
            );
        }
        let wanted_by = config.wanted_by.unwrap_or_else(|| match kind {
            SystemdUnitKind::Service => vec!["default.target".to_string()],
            SystemdUnitKind::Timer => vec!["timers.target".to_string()],
        });
        Ok(Self {
            unit: format!(
                "dev.mise.{name}.{}",
                match kind {
                    SystemdUnitKind::Service => "service",
                    SystemdUnitKind::Timer => "timer",
                }
            ),
            name,
            kind,
            description: config.description,

View on GitHub (pinned to afd2eddd3a)

Solutions

Write the umask as a 4-digit octal string in 0000..0777, e.g. `umask = "0022"`.
Remove non-octal digits (no 8 or 9 allowed).
Remove the `umask` key to use the systemd default.

Example fix

# before
[systemd.myapp]
exec_start = "/usr/bin/myapp"
umask = "0888"

# after
[systemd.myapp]
exec_start = "/usr/bin/myapp"
umask = "0022"

Defensive patterns

Strategy: validation

Validate before calling

fn valid_umask(s: &str) -> bool {
    s.len() == 4 && s.chars().all(|c| ('0'..='7').contains(&c))
        && s <= "0777"
}
assert!(valid_umask("0022") && !valid_umask("0888"));

Prevention

Always write umask as a 4-digit octal string (e.g. "0022").
Remember octal digits only go 0-7.
Validate umask strings at config-generation time, not deploy time.

When it happens

Trigger: Setting `umask` in a `[systemd.<name>]` service block to a string that fails `valid_umask` — e.g. `"777"` (below 0000 range semantics ok but under 4 digits depending on validator), `"0888"` (digits 8/9 are not octal), `"1777"` (above 0777), or non-numeric text.

Common situations: Writing decimal instead of octal (e.g. `umask = "022"` is fine but `umask = "22"` or `"18"` is not); including a leading mode digit above 7; typos copying umask from shell docs.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/a07b0d9ecc86f729. Report an issue: GitHub.