I write this ticket to advocate for the addition of the "pam_umask.so" plugin. This plugin, when enabled, will by default honor the "UMASK" value specified in /etc/login.defs, which is historically what you'd be modifying to set the default umask value. By default, this is 022, which is what everyone already has on their systems, so adding this plugin should not cause any disturbances. I think it's sensible to add this line to /etc/pam.d/system-login (which is inherited both by login/system-local-login and sshd/system-remote-login): session optional pam_umask.so
Arch linux seems to agree: https://gitlab.archlinux.org/archlinux/packaging/packages/pambase/-/blob/main/system-login?ref_type=heads Slackware puts it in the elogind-user file. Debian and Ubuntu put it in common-session and common-session-noninteractive, which is inherited by login, su, sudo, sshd, etc. Fedora puts it in postlogin (file generated by authselect), which is inherited by login, su, sshd, etc. OpenSUSE puts it in common-session and common-session-nonlogin, which is... only inherited by smtp? there's no login, su, sshd and other files...
