Arch Linux

My login.defs is untouched and only contains the UMASK 077 line. Perhaps you mean /etc/profile for the second one?

The /etc/profile setting should not affect pam.

The one in login.defs should be the default, and is there for default home directory permissions and non-shell based things. 022 is later set in the shell by /etc/profile as it's a little more friendly to multi-user machines.

I am not really sure what the issue here is. If you're changing your system configuration, it's expected to change config files.... this would be part of that. If there is a bug in pam, please report it upstream.

"Does not work" is a terrible bug description. Can you please attempt to explain in more detail?

> Perhaps you mean /etc/profile for the second one?

Correct! (Sorry, cut and waste)

> The /etc/profile setting should not affect pam.

But it does!

The setting in the /etc/profile overwrites the setting which is done by pam_umask because of the fact that the shell is executed after PAM.

Test Case 1:
I added following line at the end of /etc/pam.d/login and /etc/pam.d/su
session optional pam_umask.so

and modified /etc/passwd (umask=0077) in the GECOS field
USER:x:UID:GID:umask=0077:HOME:SHELL

If I login in with the default configuration in /etc/profile (umask 022):
$ umask
0022

Test Case 2:
Modify /etc/pam.d/login and /etc/passwd as mentioned above, comment the relevant line in /etc/profile and login in:
$ umask
0077

> I am not really sure what the issue here is.

I see. If you login or invoke a login shell (su -, the minus is essential) you will first read /etc/login.defs and then /etc/profile.
This will result every time in umask 022 which is the default value if you omit the configuration in /etc/login.defs and /etc/profile at all!

# strace -f su - waldeck
124:6349 open("/lib/security/pam_umask.so", O_RDONLY) = 4
...
201:6349 open("/etc/login.defs", O_RDONLY|O_LARGEFILE) = 3
...
416:6350 open("/etc/profile", O_RDONLY|O_LARGEFILE) = 3

The first number in a row is the line number from grep -n.
I got correponding results from the tracing of login.

Fortunately the UMASK setting in /etc/login.defs does not change an already existing umask setting from pam_umask
BUT the umask invocation in /etc/profile definitely modifies the umask value.

I don't know why the commect was added a second time :-(.

No no, you're missing what I'm saying.

The /etc/profile value DOES NOT affect pam. However, it does come into play with new shells. If you're configuring your system to set umasks via pam, you'll want to remove the umask value from /etc/profile, or something similar. There is no sane way to do something like this globally. Config files are there to be modified if needed. They are solely sane defaults

Aaron so i can close this?

Aye, close as Not A Bug. Global shell configuration should be left to the system administrator, and does not affect pam, only the shell launched at login.