Am 04.04.2016 um 04:54 schrieb fsmithred:

>    session optional pam_umask.so umask=0022"

Add such customization to

    /etc/pam.d/common-session

instead. The statement should appear after the end of the block that is
automatically updated by "pam-auth-update", i.e. it should follow the line

    # end of pam-auth-update config

I tested the statement

    session optional pam_umask.so umask=0027

and it gives me the expected result.

See /etc/pam.d/common-session and pam-auth-update(8) for more details.

Kind regards,
T.