# Where PAM sets an individual user's umask from GECOS field of passwd:

session optional			pam_umask.so

# Default umask will be picked up from /etc/login.defs


# It is reported that setting umask in /etc/profile will override PAM
# because that file is read later during the login process.

# This line will need to be added to /etc/pam.d/system-auth in Arch
# - documentation says to add it to login, but xsessions are missed.

# For Devuan/Debian, add it to the end of /etc/pam.d/common-session.


# A useful command to search for an existing pam_umask entry in all
# of the files in /etc/pam.d or whatever the current directory:

for f in * ; do echo $f ; grep -i umask $f ; done

# For Debian-based distros, add the following to common-session:

# Set system wide umask. Since group=user in almost all cases default=0002
# This is due to the usergroups parameter which forces groupbits = userbits
#  where group and user are identical.
#session optional pam_umask.so usergroups umask=0007
session optional pam_umask.so
# The above minimal line gets default umask from /etc/login.defs