diff --git a/kernel/src/debug/tracing/mod.rs b/kernel/src/debug/tracing/mod.rs
index b64f2639f..f08938b6c 100644
--- a/kernel/src/debug/tracing/mod.rs
+++ b/kernel/src/debug/tracing/mod.rs
@@ -122,7 +122,7 @@ pub fn init_debugfs_tracing() -> Result<(), SystemError> {
 
     tracing_root.add_file(
         "trace_pipe".to_string(),
-        ModeType::from_bits_truncate(0o444),
+        ModeType::S_IRUGO,
         Some(4096),
         None,
         Some(&trace_pipe::TracePipeCallBack),
@@ -133,7 +133,7 @@ pub fn init_debugfs_tracing() -> Result<(), SystemError> {
     )?;
     tracing_root.add_file(
         "saved_cmdlines_size".to_string(),
-        ModeType::from_bits_truncate(0o444),
+        ModeType::S_IRUGO,
         None,
         None,
         Some(&trace_pipe::SavedCmdlinesSizeCallBack),
diff --git a/kernel/src/debug/tracing/trace_pipe.rs b/kernel/src/debug/tracing/trace_pipe.rs
index 7d49be510..8ee10a58e 100644
--- a/kernel/src/debug/tracing/trace_pipe.rs
+++ b/kernel/src/debug/tracing/trace_pipe.rs
@@ -91,7 +91,7 @@ impl KernFSCallback for TraceCallBack {
 
 pub fn kernel_inode_provider_trace() -> KernFSInodeArgs {
     KernFSInodeArgs {
-        mode: ModeType::from_bits_truncate(0o444),
+        mode: ModeType::S_IRUGO,
         callback: Some(&TraceCallBack),
         inode_type: KernInodeType::File,
         size: Some(4096),
@@ -205,7 +205,7 @@ impl KernFSCallback for SavedCmdlinesSizeCallBack {
 
 pub fn kernel_inode_provider_saved_cmdlines() -> KernFSInodeArgs {
     KernFSInodeArgs {
-        mode: ModeType::from_bits_truncate(0o444),
+        mode: ModeType::S_IRUGO,
         callback: Some(&SavedCmdlinesSnapshotCallBack),
         inode_type: KernInodeType::File,
         size: Some(4096),
diff --git a/kernel/src/filesystem/devfs/mod.rs b/kernel/src/filesystem/devfs/mod.rs
index e77ea447e..975a5823b 100644
--- a/kernel/src/filesystem/devfs/mod.rs
+++ b/kernel/src/filesystem/devfs/mod.rs
@@ -361,12 +361,8 @@ impl LockedDevFSInode {
     /// - `path`: 符号链接指向的路径
     /// - `symlink_name`: 符号链接的名称
     pub fn add_dev_symlink(&self, path: &str, symlink_name: &str) -> Result<(), SystemError> {
-        let new_inode = self.create_with_data(
-            symlink_name,
-            FileType::SymLink,
-            ModeType::from_bits_truncate(0o777),
-            0,
-        )?;
+        let new_inode =
+            self.create_with_data(symlink_name, FileType::SymLink, ModeType::S_IRWXUGO, 0)?;
 
         let buf = path.as_bytes();
         let len = buf.len();
diff --git a/kernel/src/filesystem/devpts/mod.rs b/kernel/src/filesystem/devpts/mod.rs
index a67feaef5..d9845a3cf 100644
--- a/kernel/src/filesystem/devpts/mod.rs
+++ b/kernel/src/filesystem/devpts/mod.rs
@@ -117,7 +117,7 @@ impl LockedDevPtsFSInode {
                     ctime: PosixTimeSpec::default(),
                     btime: PosixTimeSpec::default(),
                     file_type: FileType::Dir,
-                    mode: ModeType::from_bits_truncate(0o777),
+                    mode: ModeType::S_IRWXUGO,
                     nlinks: 1,
                     uid: 0,
                     gid: 0,
diff --git a/kernel/src/filesystem/fat/fs.rs b/kernel/src/filesystem/fat/fs.rs
index e8dad51aa..2709a8263 100644
--- a/kernel/src/filesystem/fat/fs.rs
+++ b/kernel/src/filesystem/fat/fs.rs
@@ -237,7 +237,7 @@ impl LockedFATInode {
                 ctime: PosixTimeSpec::default(),
                 btime: PosixTimeSpec::default(),
                 file_type,
-                mode: ModeType::from_bits_truncate(0o777),
+                mode: ModeType::S_IRWXUGO,
                 nlinks: 1,
                 uid: 0,
                 gid: 0,
@@ -502,7 +502,7 @@ impl FATFileSystem {
                 ctime: PosixTimeSpec::default(),
                 btime: PosixTimeSpec::default(),
                 file_type: FileType::Dir,
-                mode: ModeType::from_bits_truncate(0o777),
+                mode: ModeType::S_IRWXUGO,
                 nlinks: 1,
                 uid: 0,
                 gid: 0,
@@ -1999,18 +1999,28 @@ impl IndexNode for LockedFATInode {
         mode: ModeType,
         _dev_t: DeviceNumber,
     ) -> Result<Arc<dyn IndexNode>, SystemError> {
-        let inode = self.0.lock();
+        let mut inode = self.0.lock();
         if inode.metadata.file_type != FileType::Dir {
             return Err(SystemError::ENOTDIR);
         }
-        drop(inode);
+
+        let mode = if (mode.bits() & ModeType::S_IFMT.bits()) == 0 {
+            mode | ModeType::S_IFREG
+        } else {
+            mode
+        };
+        let umask = crate::process::ProcessManager::current_pcb()
+            .fs_struct()
+            .umask();
+        let final_mode = mode & !umask;
 
         // 判断需要创建的类型
-        if unlikely(mode.contains(ModeType::S_IFREG)) {
+        if unlikely(final_mode.contains(ModeType::S_IFREG)) {
             // 普通文件
+            drop(inode);
             return self.create(filename, FileType::File, mode);
         }
-        let mut inode = self.0.lock();
+
         let dname = DName::from(filename);
         let nod = LockedFATInode::new(
             dname,
@@ -2019,16 +2029,16 @@ impl IndexNode for LockedFATInode {
             FATDirEntry::File(FATFile::default()),
         );
 
-        if mode.contains(ModeType::S_IFIFO) {
+        if final_mode.contains(ModeType::S_IFIFO) {
             nod.0.lock().metadata.file_type = FileType::Pipe;
             // 创建pipe文件
             let pipe_inode = LockedPipeInode::new();
             // 设置special_node
             nod.0.lock().special_node = Some(SpecialNodeData::Pipe(pipe_inode));
-        } else if mode.contains(ModeType::S_IFBLK) {
+        } else if final_mode.contains(ModeType::S_IFBLK) {
             nod.0.lock().metadata.file_type = FileType::BlockDevice;
             unimplemented!()
-        } else if mode.contains(ModeType::S_IFCHR) {
+        } else if final_mode.contains(ModeType::S_IFCHR) {
             nod.0.lock().metadata.file_type = FileType::CharDevice;
             unimplemented!()
         } else {
diff --git a/kernel/src/filesystem/fs.rs b/kernel/src/filesystem/fs.rs
index f12534bde..f754a5d3a 100644
--- a/kernel/src/filesystem/fs.rs
+++ b/kernel/src/filesystem/fs.rs
@@ -1,3 +1,5 @@
+use core::sync::atomic::{AtomicU32, Ordering};
+
 use alloc::sync::Arc;
 
 use crate::filesystem::vfs::syscall::ModeType;
@@ -21,14 +23,15 @@ impl PathContext {
 
 #[derive(Debug)]
 pub struct FsStruct {
-    umask: ModeType, //文件权限掩码
+    umask: AtomicU32, // 文件权限掩码 ModeType
     path_context: RwLock<PathContext>,
 }
 
 impl Clone for FsStruct {
     fn clone(&self) -> Self {
+        let current_umask = self.umask.load(Ordering::Relaxed);
         Self {
-            umask: self.umask,
+            umask: AtomicU32::new(current_umask),
             path_context: RwLock::new(self.path_context.read().clone()),
         }
     }
@@ -43,11 +46,23 @@ impl Default for FsStruct {
 impl FsStruct {
     pub fn new() -> Self {
         Self {
-            umask: ModeType::S_IWUGO,
+            umask: AtomicU32::new(ModeType::S_IWUGO.bits()),
             path_context: RwLock::new(PathContext::new()),
         }
     }
 
+    pub fn umask(&self) -> ModeType {
+        ModeType::from_bits_truncate(self.umask.load(Ordering::SeqCst))
+    }
+
+    /// Linux: xchg(&current->fs->umask, mask & S_IRWXUGO)
+    pub fn set_umask(&self, mask: ModeType) -> ModeType {
+        ModeType::from_bits_truncate(
+            self.umask
+                .swap(mask.bits() & ModeType::S_IRWXUGO.bits(), Ordering::SeqCst),
+        )
+    }
+
     pub fn set_root(&self, inode: Arc<dyn IndexNode>) {
         self.path_context.write().root = inode;
     }
diff --git a/kernel/src/filesystem/kernfs/mod.rs b/kernel/src/filesystem/kernfs/mod.rs
index 5a361f173..3c6314213 100644
--- a/kernel/src/filesystem/kernfs/mod.rs
+++ b/kernel/src/filesystem/kernfs/mod.rs
@@ -639,7 +639,7 @@ impl KernFSInode {
         let inode = self.inner_create(
             name,
             KernInodeType::SymLink,
-            ModeType::S_IFLNK | ModeType::from_bits_truncate(0o777),
+            ModeType::S_IFLNK | ModeType::S_IRWXUGO,
             0,
             None,
             None,
diff --git a/kernel/src/filesystem/procfs/mod.rs b/kernel/src/filesystem/procfs/mod.rs
index e85aa54c9..220f723fd 100644
--- a/kernel/src/filesystem/procfs/mod.rs
+++ b/kernel/src/filesystem/procfs/mod.rs
@@ -612,11 +612,7 @@ impl ProcFS {
         )?;
         // 创建相关文件
         // status文件
-        let status_binding = pid_dir.create(
-            "status",
-            FileType::File,
-            ModeType::from_bits_truncate(0o444),
-        )?;
+        let status_binding = pid_dir.create("status", FileType::File, ModeType::S_IRUGO)?;
         let status_file: &LockedProcFSInode = status_binding
             .as_any_ref()
             .downcast_ref::<LockedProcFSInode>()
@@ -625,12 +621,8 @@ impl ProcFS {
         status_file.0.lock().fdata.ftype = ProcFileType::ProcStatus;
 
         // exe文件
-        let exe_binding = pid_dir.create_with_data(
-            "exe",
-            FileType::SymLink,
-            ModeType::from_bits_truncate(0o444),
-            0,
-        )?;
+        let exe_binding =
+            pid_dir.create_with_data("exe", FileType::SymLink, ModeType::S_IRUGO, 0)?;
         let exe_file = exe_binding
             .as_any_ref()
             .downcast_ref::<LockedProcFSInode>()
@@ -720,11 +712,7 @@ impl LockedProcFSInode {
         let file = fd_table.get_file_by_fd(fd);
         if file.is_some() {
             let _ = self.unlink(&fd.to_string());
-            let fd_file = self.create(
-                &fd.to_string(),
-                FileType::SymLink,
-                ModeType::from_bits_truncate(0o444),
-            )?;
+            let fd_file = self.create(&fd.to_string(), FileType::SymLink, ModeType::S_IRUGO)?;
             let fd_file_proc = fd_file
                 .as_any_ref()
                 .downcast_ref::<LockedProcFSInode>()
diff --git a/kernel/src/filesystem/ramfs/mod.rs b/kernel/src/filesystem/ramfs/mod.rs
index 0c8a0d44d..26c275798 100644
--- a/kernel/src/filesystem/ramfs/mod.rs
+++ b/kernel/src/filesystem/ramfs/mod.rs
@@ -90,7 +90,7 @@ impl RamFSInode {
                 ctime: PosixTimeSpec::default(),
                 btime: PosixTimeSpec::default(),
                 file_type: FileType::Dir,
-                mode: ModeType::from_bits_truncate(0o777),
+                mode: ModeType::S_IRWXUGO,
                 nlinks: 1,
                 uid: 0,
                 gid: 0,
diff --git a/kernel/src/filesystem/sysfs/file.rs b/kernel/src/filesystem/sysfs/file.rs
index 1d65be42b..669592847 100644
--- a/kernel/src/filesystem/sysfs/file.rs
+++ b/kernel/src/filesystem/sysfs/file.rs
@@ -154,7 +154,7 @@ impl SysFS {
         let sys_priv = SysFSKernPrivateData::File(SysKernFilePriv::new(&kobj, Some(attr), None));
         let r = parent.add_file(
             attr.name().to_string(),
-            mode.bitand(ModeType::from_bits_truncate(0o777)),
+            mode.bitand(ModeType::S_IRWXUGO),
             Some(4096),
             Some(KernInodePrivateData::SysFS(sys_priv)),
             Some(kern_callback),
@@ -266,7 +266,7 @@ impl SysFS {
             SysFSKernPrivateData::File(SysKernFilePriv::new(&kobj, None, Some(attr.clone())));
         let r = parent.add_file(
             attr.name().to_string(),
-            mode.bitand(ModeType::from_bits_truncate(0o777)),
+            mode.bitand(ModeType::S_IRWXUGO),
             Some(attr.size()),
             Some(KernInodePrivateData::SysFS(sys_priv)),
             Some(kern_callback),
diff --git a/kernel/src/filesystem/sysfs/mod.rs b/kernel/src/filesystem/sysfs/mod.rs
index 9cb848df8..3d056109e 100644
--- a/kernel/src/filesystem/sysfs/mod.rs
+++ b/kernel/src/filesystem/sysfs/mod.rs
@@ -118,7 +118,7 @@ pub trait AttributeGroup: Debug + Send + Sync {
 }
 
 /// sysfs只读属性文件的权限
-pub const SYSFS_ATTR_MODE_RO: ModeType = ModeType::from_bits_truncate(0o444);
+pub const SYSFS_ATTR_MODE_RO: ModeType = ModeType::S_IRUGO;
 /// sysfs只写属性文件的权限
 pub const SYSFS_ATTR_MODE_WO: ModeType = ModeType::from_bits_truncate(0o200);
 /// sysfs读写属性文件的权限
diff --git a/kernel/src/filesystem/vfs/mount.rs b/kernel/src/filesystem/vfs/mount.rs
index ead3e2fe6..890f556d2 100644
--- a/kernel/src/filesystem/vfs/mount.rs
+++ b/kernel/src/filesystem/vfs/mount.rs
@@ -1277,7 +1277,7 @@ pub fn do_mount_mkdir(
     let inode = do_mkdir_at(
         AtFlags::AT_FDCWD.bits(),
         mount_point,
-        FileMode::from_bits_truncate(0o755),
+        ModeType::from_bits_truncate(0o755),
     )?;
     let result = ProcessManager::current_mntns().get_mount_point(mount_point);
     if let Some((_, rest, _fs)) = result {
diff --git a/kernel/src/filesystem/vfs/permission.rs b/kernel/src/filesystem/vfs/permission.rs
index 25f84cb8f..92dcacc24 100644
--- a/kernel/src/filesystem/vfs/permission.rs
+++ b/kernel/src/filesystem/vfs/permission.rs
@@ -69,10 +69,10 @@ impl Cred {
         // 确定要检查哪组权限位
         let perm = if self.is_owner(metadata) {
             // 所有者权限（第 6-8 位）
-            file_mode & ModeType::S_IRWXU.bits() >> 6
+            (file_mode & ModeType::S_IRWXU.bits()) >> 6
         } else if self.in_group(metadata) {
             // 组权限（第 3-5 位）
-            file_mode & ModeType::S_IRWXG.bits() >> 3
+            (file_mode & ModeType::S_IRWXG.bits()) >> 3
         } else {
             // 其他用户权限（第 0-2 位）
             file_mode & ModeType::S_IRWXO.bits()
@@ -107,7 +107,6 @@ impl Cred {
         if self.fsgid.data() == metadata.gid {
             return true;
         }
-
         // 检查附加组
         self.groups.iter().any(|gid| gid.data() == metadata.gid)
     }
@@ -121,30 +120,31 @@ impl Cred {
     fn try_capability_override(&self, metadata: &Metadata, mask: u32) -> bool {
         // CAP_DAC_OVERRIDE: 绕过所有文件读、写和执行权限检查
         if self.has_capability(CAPFlags::CAP_DAC_OVERRIDE) {
-            // 对于目录：总是允许
-            if metadata.file_type == super::FileType::Dir {
-                return true;
-            }
-
-            // 对于文件：如果不是仅执行请求，或文件对某人可执行，则允许
-            if mask != PermissionMask::MAY_EXEC.bits() {
-                return true;
-            }
-            if metadata.mode.bits() & PermissionMask::MAY_RWX.bits() != 0 {
+            // 对于目录或文件，只要满足下列条件之一就允许
+            if metadata.file_type == super::FileType::Dir
+                || mask & PermissionMask::MAY_EXEC.bits() == 0
+                || metadata.mode.bits() & PermissionMask::MAY_RWX.bits() != 0
+            {
                 return true;
             }
         }
 
         // CAP_DAC_READ_SEARCH: 绕过读和搜索（目录上的执行）检查
         if self.has_capability(CAPFlags::CAP_DAC_READ_SEARCH) {
-            // 允许读任何文件
-            if mask == PermissionMask::MAY_READ.bits() {
-                return true;
-            }
-
-            // 允许搜索（执行）目录
-            if metadata.file_type == FileType::Dir && mask == PermissionMask::MAY_EXEC.bits() {
-                return true;
+            // 目录：只要不请求写权限，就允许 (即允许 Read 和 Exec/Search)
+            if metadata.file_type == FileType::Dir {
+                if (mask & PermissionMask::MAY_WRITE.bits()) == 0 {
+                    return true;
+                }
+            } else {
+                // 文件：仅允许只读权限
+                let check_mask = mask
+                    & (PermissionMask::MAY_READ.bits()
+                        | PermissionMask::MAY_EXEC.bits()
+                        | PermissionMask::MAY_WRITE.bits());
+                if check_mask == PermissionMask::MAY_READ.bits() {
+                    return true;
+                }
             }
         }
 
diff --git a/kernel/src/filesystem/vfs/syscall/symlink_utils.rs b/kernel/src/filesystem/vfs/syscall/symlink_utils.rs
index 092803f01..8e45ac624 100644
--- a/kernel/src/filesystem/vfs/syscall/symlink_utils.rs
+++ b/kernel/src/filesystem/vfs/syscall/symlink_utils.rs
@@ -36,12 +36,8 @@ pub fn do_symlinkat(from: &str, newdfd: Option<i32>, to: &str) -> Result<usize,
         return Err(SystemError::ENOTDIR);
     }
 
-    let new_inode = new_parent.create_with_data(
-        new_name,
-        FileType::SymLink,
-        ModeType::from_bits_truncate(0o777),
-        0,
-    )?;
+    let new_inode =
+        new_parent.create_with_data(new_name, FileType::SymLink, ModeType::S_IRWXUGO, 0)?;
 
     let buf = old_remain_path.as_bytes();
     let len = buf.len();
diff --git a/kernel/src/filesystem/vfs/syscall/sys_mkdir.rs b/kernel/src/filesystem/vfs/syscall/sys_mkdir.rs
index 4f8e21273..c11de53d1 100644
--- a/kernel/src/filesystem/vfs/syscall/sys_mkdir.rs
+++ b/kernel/src/filesystem/vfs/syscall/sys_mkdir.rs
@@ -1,7 +1,7 @@
 use crate::arch::interrupt::TrapFrame;
 use crate::arch::syscall::nr::SYS_MKDIR;
 use crate::filesystem::vfs::fcntl::AtFlags;
-use crate::filesystem::vfs::file::FileMode;
+use crate::filesystem::vfs::syscall::ModeType;
 use crate::filesystem::vfs::vcore::do_mkdir_at;
 use crate::syscall::table::FormattedSyscallParam;
 use crate::syscall::table::Syscall;
@@ -35,7 +35,7 @@ impl Syscall for SysMkdirHandle {
         do_mkdir_at(
             AtFlags::AT_FDCWD.bits(),
             &path,
-            FileMode::from_bits_truncate(mode as u32),
+            ModeType::from_bits_truncate(mode as u32),
         )?;
         return Ok(0);
     }
diff --git a/kernel/src/filesystem/vfs/syscall/sys_mkdirat.rs b/kernel/src/filesystem/vfs/syscall/sys_mkdirat.rs
index 2fd71cdb6..6f7b38f79 100644
--- a/kernel/src/filesystem/vfs/syscall/sys_mkdirat.rs
+++ b/kernel/src/filesystem/vfs/syscall/sys_mkdirat.rs
@@ -2,7 +2,7 @@
 
 use crate::arch::interrupt::TrapFrame;
 use crate::arch::syscall::nr::SYS_MKDIRAT;
-use crate::filesystem::vfs::file::FileMode;
+use crate::filesystem::vfs::syscall::ModeType;
 use crate::filesystem::vfs::vcore::do_mkdir_at;
 use crate::syscall::table::{FormattedSyscallParam, Syscall};
 use alloc::vec::Vec;
@@ -28,7 +28,7 @@ impl Syscall for SysMkdirAtHandle {
         )?
         .into_string()
         .map_err(|_| SystemError::EINVAL)?;
-        do_mkdir_at(dirfd, &path, FileMode::from_bits_truncate(mode as u32))?;
+        do_mkdir_at(dirfd, &path, ModeType::from_bits_truncate(mode as u32))?;
         Ok(0)
     }
 
diff --git a/kernel/src/filesystem/vfs/vcore.rs b/kernel/src/filesystem/vfs/vcore.rs
index 7fbd13b2c..b862fa9a8 100644
--- a/kernel/src/filesystem/vfs/vcore.rs
+++ b/kernel/src/filesystem/vfs/vcore.rs
@@ -4,6 +4,7 @@ use alloc::sync::Arc;
 use log::{error, info};
 use system_error::SystemError;
 
+use crate::filesystem::vfs::permission::PermissionMask;
 use crate::libs::casting::DowncastArc;
 use crate::{
     define_event_trace,
@@ -21,7 +22,6 @@ use crate::{
 };
 
 use super::{
-    file::FileMode,
     stat::LookUpFlags,
     utils::{rsplit_path, user_path_at},
     IndexNode, InodeId, VFS_MAX_FOLLOW_SYMLINK_TIMES,
@@ -182,9 +182,9 @@ pub fn change_root_fs() -> Result<(), SystemError> {
 define_event_trace!(
     do_mkdir_at,
     TP_system(vfs),
-    TP_PROTO(path:&str, mode: FileMode),
+    TP_PROTO(path:&str, mode: ModeType),
     TP_STRUCT__entry {
-        fmode: FileMode,
+        fmode: ModeType,
         path: [u8;64],
     },
     TP_fast_assign {
@@ -205,21 +205,52 @@ define_event_trace!(
         format!("mkdir at {} with mode {:?}", path, mode)
     })
 );
+
 /// @brief 创建文件/文件夹
 pub fn do_mkdir_at(
     dirfd: i32,
     path: &str,
-    mode: FileMode,
+    mode: ModeType,
 ) -> Result<Arc<dyn IndexNode>, SystemError> {
     trace_do_mkdir_at(path, mode);
+    if path.is_empty() {
+        return Err(SystemError::ENOENT);
+    }
     let (mut current_inode, path) =
         user_path_at(&ProcessManager::current_pcb(), dirfd, path.trim())?;
-    let (name, parent) = rsplit_path(&path);
+    // Linux 返回 EEXIST
+    let path = path.trim_end_matches('/');
+    if path.is_empty() {
+        return Err(SystemError::EEXIST);
+    }
+    let (name, parent) = rsplit_path(path);
+    if name == "." || name == ".." {
+        return Err(SystemError::EEXIST);
+    }
     if let Some(parent) = parent {
         current_inode =
             current_inode.lookup_follow_symlink(parent, VFS_MAX_FOLLOW_SYMLINK_TIMES)?;
     }
-    return current_inode.mkdir(name, ModeType::from_bits_truncate(mode.bits()));
+    let parent_md = current_inode.metadata()?;
+    // 确保父节点是目录
+    if parent_md.file_type != FileType::Dir {
+        return Err(SystemError::ENOTDIR);
+    }
+    let pcb = ProcessManager::current_pcb();
+    let cred = pcb.cred();
+    cred.inode_permission(&parent_md, PermissionMask::MAY_EXEC.bits())?;
+    if current_inode.find(name).is_ok() {
+        return Err(SystemError::EEXIST);
+    }
+    let mut final_mode_bits = mode.bits() & ModeType::S_IRWXUGO.bits();
+    if (parent_md.mode.bits() & ModeType::S_ISGID.bits()) != 0 {
+        final_mode_bits |= ModeType::S_ISGID.bits();
+    }
+    let umask = pcb.fs_struct().umask();
+    let final_mode = ModeType::from_bits_truncate(final_mode_bits) & !umask;
+
+    // 执行创建
+    return current_inode.mkdir(name, final_mode);
 }
 
 /// 解析父目录inode
diff --git a/kernel/src/init/initram.rs b/kernel/src/init/initram.rs
index a44e7a35d..6071a8de3 100644
--- a/kernel/src/init/initram.rs
+++ b/kernel/src/init/initram.rs
@@ -203,12 +203,8 @@ pub fn initramfs_init() -> Result<(), SystemError> {
             log::error!("initramfs: failed to get utf8_name, err is {}", err);
             SystemError::EINVAL
         })?;
-        let new_inode = parent_inode.create_with_data(
-            filename,
-            FileType::SymLink,
-            ModeType::from_bits_truncate(0o777),
-            0,
-        )?;
+        let new_inode =
+            parent_inode.create_with_data(filename, FileType::SymLink, ModeType::S_IRWXUGO, 0)?;
         let buf = other_name.as_bytes();
         let len = buf.len();
         new_inode.write_at(0, len, buf, SpinLock::new(FilePrivateData::Unused).lock())?;
diff --git a/kernel/src/process/fork.rs b/kernel/src/process/fork.rs
index 5953a1136..c3f0917f5 100644
--- a/kernel/src/process/fork.rs
+++ b/kernel/src/process/fork.rs
@@ -500,8 +500,7 @@ impl ProcessManager {
                 ProcessManager::current_pcb().raw_pid().data(),
                 pid
             );
-            let new_inode =
-                root_inode.create(&name, FileType::File, ModeType::from_bits_truncate(0o777))?;
+            let new_inode = root_inode.create(&name, FileType::File, ModeType::S_IRWXUGO)?;
             let file = File::new(new_inode, FileMode::O_RDWR | FileMode::O_CLOEXEC)?;
             {
                 let mut guard = file.private_data.lock();
diff --git a/kernel/src/process/syscall/mod.rs b/kernel/src/process/syscall/mod.rs
index feca6ea3f..a5d79e280 100644
--- a/kernel/src/process/syscall/mod.rs
+++ b/kernel/src/process/syscall/mod.rs
@@ -32,6 +32,7 @@ mod sys_setresgid;
 mod sys_setresuid;
 mod sys_setsid;
 mod sys_setuid;
+mod sys_umask;
 mod sys_uname;
 mod sys_unshare;
 mod sys_wait4;
diff --git a/kernel/src/process/syscall/sys_umask.rs b/kernel/src/process/syscall/sys_umask.rs
new file mode 100644
index 000000000..5aa0b9174
--- /dev/null
+++ b/kernel/src/process/syscall/sys_umask.rs
@@ -0,0 +1,38 @@
+use crate::arch::interrupt::TrapFrame;
+use crate::arch::syscall::nr::SYS_UMASK;
+use crate::filesystem::vfs::syscall::ModeType;
+use crate::process::ProcessManager;
+use crate::syscall::table::{FormattedSyscallParam, Syscall};
+use alloc::vec::Vec;
+use system_error::SystemError;
+
+pub struct SysUmaskHandle;
+
+impl SysUmaskHandle {
+    fn mask(args: &[usize]) -> ModeType {
+        ModeType::from_bits_truncate(args[0] as u32)
+    }
+}
+
+impl Syscall for SysUmaskHandle {
+    fn num_args(&self) -> usize {
+        1
+    }
+
+    fn handle(&self, args: &[usize], _frame: &mut TrapFrame) -> Result<usize, SystemError> {
+        let new_mask = Self::mask(args) & ModeType::S_IRWXUGO;
+        let old_mask = ProcessManager::current_pcb()
+            .fs_struct()
+            .set_umask(new_mask);
+        Ok(old_mask.bits() as usize)
+    }
+
+    fn entry_format(&self, args: &[usize]) -> Vec<FormattedSyscallParam> {
+        vec![FormattedSyscallParam::new(
+            "mask",
+            format!("{:#o}", Self::mask(args)),
+        )]
+    }
+}
+
+syscall_table_macros::declare_syscall!(SYS_UMASK, SysUmaskHandle);
diff --git a/kernel/src/syscall/misc.rs b/kernel/src/syscall/misc.rs
index 2992d2ba0..fa2b06b01 100644
--- a/kernel/src/syscall/misc.rs
+++ b/kernel/src/syscall/misc.rs
@@ -5,13 +5,10 @@ use crate::{
 };
 use alloc::vec::Vec;
 use core::cmp;
-use log::warn;
 use system_error::SystemError;
 
 use super::{user_access::UserBufferWriter, Syscall};
 
-static mut UMASK: usize = 0o777;
-
 /// 系统信息
 ///
 /// 参考 https://code.dragonos.org.cn/xref/linux-6.1.9/include/uapi/linux/sysinfo.h#8
@@ -60,13 +57,6 @@ impl Syscall {
         return Ok(0);
     }
 
-    pub fn umask(mask: u32) -> Result<usize, SystemError> {
-        warn!("SYS_UMASK has not yet been implemented\n");
-        let r = unsafe { UMASK };
-        unsafe { UMASK = mask as usize };
-        return Ok(r);
-    }
-
     /// ## 将随机字节填入buf
     /// ### 该系统调用与linux不一致，因为目前没有其他随机源
     pub fn get_random(buf: *mut u8, len: usize, flags: GRandFlags) -> Result<usize, SystemError> {
diff --git a/kernel/src/syscall/mod.rs b/kernel/src/syscall/mod.rs
index e6d2b3096..10736d7fb 100644
--- a/kernel/src/syscall/mod.rs
+++ b/kernel/src/syscall/mod.rs
@@ -327,11 +327,6 @@ impl Syscall {
                 Self::sysinfo(info)
             }
 
-            SYS_UMASK => {
-                let mask = args[0] as u32;
-                Self::umask(mask)
-            }
-
             SYS_FSYNC => {
                 warn!("SYS_FSYNC has not yet been implemented");
                 Ok(0)
diff --git a/user/apps/tests/syscall/gvisor/blocklists/mkdir_test b/user/apps/tests/syscall/gvisor/blocklists/mkdir_test
new file mode 100644
index 000000000..d3e5858f1
--- /dev/null
+++ b/user/apps/tests/syscall/gvisor/blocklists/mkdir_test
@@ -0,0 +1,4 @@
+# FAT 不支持文件权限导致的报错
+MkdirTest.HonorsUmask
+MkdirTest.HonorsUmask2
+MkdirTest.FailsOnDirWithoutWritePerms
diff --git a/user/apps/tests/syscall/gvisor/blocklists/mknod_test b/user/apps/tests/syscall/gvisor/blocklists/mknod_test
index beb0eb613..1bd069286 100644
--- a/user/apps/tests/syscall/gvisor/blocklists/mknod_test
+++ b/user/apps/tests/syscall/gvisor/blocklists/mknod_test
@@ -1,4 +1,4 @@
-# sys_umask未实现
+# FAT 不支持文件权限导致的报错
 MknodTest.RegularFilePermissions
 # symlink未实现
 MknodTest.MknodOnExistingPathFails
diff --git a/user/apps/tests/syscall/gvisor/whitelist.txt b/user/apps/tests/syscall/gvisor/whitelist.txt
index e8931f1bc..cfd4fee10 100644
--- a/user/apps/tests/syscall/gvisor/whitelist.txt
+++ b/user/apps/tests/syscall/gvisor/whitelist.txt
@@ -14,6 +14,7 @@ getcpu_host_test
 # 文件系统相关测试
 dup_test
 write_test
+mkdir_test
 mknod_test
 unlink_test
 lseek_test
@@ -54,7 +55,6 @@ madvise_test
 #listen_test
 
 # 信号处理测试
-#signal_test
 sigaction_test
 sigprocmask_test
 sigaltstack_test