Is it possible to set the
umask for a system-user (created with
useradd --system username)?
There are three normal ways to set a user's umask.
There is no difference between system users and normal users in this regard.
But I'm assuming you're trying to start a daemon with a custom umask?
The problem is: all of the above options happen when a user logs in. If you're running a daemon, it never logs in. It's started by init, then either runs as root, or calls
Your main options are:
System users differ from ‘normal’ ones in three ways: password expiry, home directory (system users don't have one), and UID (system users are usually below some arbitrary threshold).
In the general case, you're almost entirely out of luck. You can use PAM to set the umask, but PAM selects behaviours based on things other than these three differences.
In other words, you can't get PAM to distinguish between a ‘system’ and ‘non-system’ users. This leaves you with two options:
Please take this answer with a generous pinch of salt. This sort of request is pretty common, and I wouldn't be surprised if a better/proper way exists now.
As @Mikel suggests, if you are trying to configure a system account which is a daemon, try configuring the daemon itself.
I came to this question looking how to set the umask for the _www account on MacOS. While this is difficult as the answers above suggest, I found I could solve it by configuring the apache service as (in this case) the user == a daemon.
I strangely couldn't find the startup script (normally in /etc/init.d/ but on a mac in Library/LaunchDaemons/), but with help from: http://krypted.com/mac-security/apache2-umasks/ discovered that apache has its own specific environment script.
Possibly other daemons have similar methods, which might help in specific cases.