diff --git a/weed/command/mount.go b/weed/command/mount.go
index ec790c999..71c1a4387 100644
--- a/weed/command/mount.go
+++ b/weed/command/mount.go
@@ -17,6 +17,7 @@ type MountOptions struct {
 	chunkSizeLimitMB   *int
 	dataCenter         *string
 	allowOthers        *bool
+	umaskString        *string
 }
 
 var (
@@ -37,6 +38,7 @@ func init() {
 	mountOptions.chunkSizeLimitMB = cmdMount.Flag.Int("chunkSizeLimitMB", 4, "local write buffer size, also chunk large files")
 	mountOptions.dataCenter = cmdMount.Flag.String("dataCenter", "", "prefer to write to the data center")
 	mountOptions.allowOthers = cmdMount.Flag.Bool("allowOthers", true, "allows other users to access the file system")
+	mountOptions.umaskString = cmdMount.Flag.String("umask", "022", "octal umask, e.g., 022, 0111")
 	mountCpuProfile = cmdMount.Flag.String("cpuprofile", "", "cpu profile output file")
 	mountMemProfile = cmdMount.Flag.String("memprofile", "", "memory profile output file")
 }
diff --git a/weed/command/mount_std.go b/weed/command/mount_std.go
index 1d1214266..0519ae7b8 100644
--- a/weed/command/mount_std.go
+++ b/weed/command/mount_std.go
@@ -27,6 +27,12 @@ func runMount(cmd *Command, args []string) bool {
 
 	util.SetupProfiling(*mountCpuProfile, *mountMemProfile)
 
+	umask, umaskErr := strconv.ParseUint(*mountOptions.umaskString, 8, 64)
+	if umaskErr != nil {
+		fmt.Printf("can not parse umask %s", *mountOptions.umaskString)
+		return false
+	}
+
 	return RunMount(
 		*mountOptions.filer,
 		*mountOptions.filerMountRootPath,
@@ -38,11 +44,12 @@ func runMount(cmd *Command, args []string) bool {
 		*mountOptions.allowOthers,
 		*mountOptions.ttlSec,
 		*mountOptions.dirListingLimit,
+		os.FileMode(umask),
 	)
 }
 
 func RunMount(filer, filerMountRootPath, dir, collection, replication, dataCenter string, chunkSizeLimitMB int,
-	allowOthers bool, ttlSec int, dirListingLimit int) bool {
+	allowOthers bool, ttlSec int, dirListingLimit int, umask os.FileMode) bool {
 
 	util.LoadConfiguration("security", false)
 
@@ -146,6 +153,7 @@ func RunMount(filer, filerMountRootPath, dir, collection, replication, dataCente
 		MountMode:          mountMode,
 		MountCtime:         fileInfo.ModTime(),
 		MountMtime:         time.Now(),
+		Umask:              umask,
 	}))
 	if err != nil {
 		fuse.Unmount(dir)
diff --git a/weed/filesys/dir.go b/weed/filesys/dir.go
index 0e9e92e16..79cf45385 100644
--- a/weed/filesys/dir.go
+++ b/weed/filesys/dir.go
@@ -101,7 +101,7 @@ func (dir *Dir) Create(ctx context.Context, req *fuse.CreateRequest,
 			Attributes: &filer_pb.FuseAttributes{
 				Mtime:       time.Now().Unix(),
 				Crtime:      time.Now().Unix(),
-				FileMode:    uint32(req.Mode),
+				FileMode:    uint32(req.Mode &^ dir.wfs.option.Umask),
 				Uid:         req.Uid,
 				Gid:         req.Gid,
 				Collection:  dir.wfs.option.Collection,
@@ -146,7 +146,7 @@ func (dir *Dir) Mkdir(ctx context.Context, req *fuse.MkdirRequest) (fs.Node, err
 				Attributes: &filer_pb.FuseAttributes{
 					Mtime:    time.Now().Unix(),
 					Crtime:   time.Now().Unix(),
-					FileMode: uint32(req.Mode),
+					FileMode: uint32(req.Mode &^ dir.wfs.option.Umask),
 					Uid:      req.Uid,
 					Gid:      req.Gid,
 				},
diff --git a/weed/filesys/dir_link.go b/weed/filesys/dir_link.go
index 92cf04d58..94e443649 100644
--- a/weed/filesys/dir_link.go
+++ b/weed/filesys/dir_link.go
@@ -27,7 +27,7 @@ func (dir *Dir) Symlink(ctx context.Context, req *fuse.SymlinkRequest) (fs.Node,
 			Attributes: &filer_pb.FuseAttributes{
 				Mtime:         time.Now().Unix(),
 				Crtime:        time.Now().Unix(),
-				FileMode:      uint32(os.FileMode(0755) | os.ModeSymlink),
+				FileMode:      uint32((os.FileMode(0777) | os.ModeSymlink) &^ dir.wfs.option.Umask),
 				Uid:           req.Uid,
 				Gid:           req.Gid,
 				SymlinkTarget: req.Target,
diff --git a/weed/filesys/filehandle.go b/weed/filesys/filehandle.go
index ceec50e13..1f4754dd1 100644
--- a/weed/filesys/filehandle.go
+++ b/weed/filesys/filehandle.go
@@ -148,7 +148,7 @@ func (fh *FileHandle) Flush(ctx context.Context, req *fuse.FlushRequest) error {
 			fh.f.entry.Attributes.Gid = req.Gid
 			fh.f.entry.Attributes.Mtime = time.Now().Unix()
 			fh.f.entry.Attributes.Crtime = time.Now().Unix()
-			fh.f.entry.Attributes.FileMode = uint32(0770)
+			fh.f.entry.Attributes.FileMode = uint32(0777 &^ fh.f.wfs.option.Umask)
 		}
 
 		request := &filer_pb.CreateEntryRequest{
diff --git a/weed/filesys/wfs.go b/weed/filesys/wfs.go
index 9018c36ed..1bd9b5cc9 100644
--- a/weed/filesys/wfs.go
+++ b/weed/filesys/wfs.go
@@ -28,6 +28,7 @@ type Option struct {
 	DataCenter         string
 	DirListingLimit    int
 	EntryCacheTtl      time.Duration
+	Umask              os.FileMode
 
 	MountUid   uint32
 	MountGid   uint32