Why is the default umask value for useradd in openSUSE set to 022

022 makes things convenient. 077 makes things less convenient, but depending on the circumstances and usage profile, it might not be any less convenient than having to use sudo.

I would argue that, like sudo, the actual, measurable security benefit you gain from this is negligible compared to the level of pain you inflict on yourself and your users. As a consultant, I have been scorned for my views on sudo and challenged to break numerous sudo setups, and I have yet to take more than 15 seconds to do so. Your call.

Knowing about umask is good, but it's just a single Corn Flake in the "complete breakfast". Maybe you should be asking yourself "Before I go mucking with default configs, the consistency of which will need to be maintained across installs, and which will need to be documented and justified to people who aren't dim-witted, what's this gonna buy me?"

Umask is also a bash built-in that is settable by individual users in their shell initialization files (~/.bash*), so you're not really able to easily enforce the umask. It's just a default. In other words, it's not buying you much.

Some Gnome applications are launched by systemd --user, in which case umask is set by systemd to 0022 regardless of the configured value for pam_umask. I am not aware of any workarounds, but I opened an issue on systemd github issue tracker. This issue is also reported on Gnome bugzilla.

Umask set using pam_umask is working as expected for applications which are not launched by systemd --user.

One workaround is suggested on Ubuntu bugzilla to place systemd service overrides to all affected applications.

Update: pam_umask should work as expected for systemd version 246 and newer. Newer distribution releases should ship with a version where the bug is fixed.

To investigate this yourself

You can list the processes running on your system in a tree format (parent/child processes) using:

pstree -Tapu

Find PIDs for: (1) your session's instance of systemd --user; (2) an application launched by it, such as gedit, which will show as child process to systemd --user; and (3) a process in your session not launched by systemd --user.

Compare umasks reported in procfs:

grep Umask /proc/<pid>/status

systemd --user itself (1) and processes not launched by it (3) should have the correct umask which was set by pam_umask. Processes launched by systemd --user (2) will have umask of 0022.