Suricata

By default no umask is set, and it is set by the shell. We should probably set it by default to something restrictive.

There seems to be no easy way for a process to know it's umask w/o also modifying it:

       It  is  impossible to use umask() to fetch a process's umask without at the same time changing it.  A second
       call to umask() would then be needed to restore the umask.  The nonatomicity of these two steps provides the
       potential for races in multithreaded programs.

So we could just set something restrictive like 0600 by default.