[SOLVED] Setting per-user umask for user without a shell?

[saturnalia0]

I set up a sandbox user for Firefox following the guide from the wiki:

https://wiki.gentoo.org/wiki/Simple_sandbox

I want to change the umask for this user only, such that new files/dirs created by the sandbox user have group write permissions (for my normal user to be able to delete files created by the sandbox user). However, the sandbox user has no shell, so I can't do it on /home/ff/.bashrc or something like that, and /etc/login.defs or /etc/pam.d/login affects *all* users, whereas I just want to change the umask for the sandbox user. How could I do this?

[Hu]

Users do not have umasks. Processes have umasks. The simplest way to achieve your goal would be to use a wrapper script that sets the desired umask, then does exec /usr/bin/firefox "$@". Then run that script instead of running Firefox directly.

[saturnalia0]

Thanks. I read some manuals and now I understand how it works. I ended up setting it on `/etc/sudoers.d/ff` since I only use `sudo` for that: