Fix umask configuration to enable group-writable files

[Copilot]

The umask was reverting to 022 instead of 002, preventing Apache and vscode users from both writing to log files and shared directories.

Root Cause

UMASK was removed from /etc/login.defs in Debian 13 (the base image was recently upgraded from Debian 12). The original fix attempted to modify this file, but the setting no longer exists there.

Changes

Dockerfile

• Configure pam_umask directly with umask=002 parameter in PAM configuration files (/etc/pam.d/common-session and /etc/pam.d/common-session-noninteractive)
• This approach works regardless of whether UMASK exists in /etc/login.defs, making it compatible with both Debian 12 and 13
• Added umask 002 to /etc/apache2/envvars for Apache processes

refresh_content.sh

• Added chmod -R g+w web/sites/default/files as temporary workaround until new containers are rebuilt
• Marked with TODO for removal once Dockerfile fix is deployed

Technical Details

PAM's pam_umask module accepts a direct umask= parameter, which is more robust than relying on /etc/login.defs. The sed pattern simply adds umask=002 after pam_umask.so in the PAM configuration files.

[!WARNING]

Original prompt

---

This section details on the original issue you should resolve

<filter_complete></filter_complete>

<issue_title>Fix umask</issue_title>
<issue_description>We seem to be back to 022 for the umask. This breaks local logging.

Step 1: add chmod -R g+w web/sites/default/files to uceap refresh-content as temporary workaround

Step 2: fix the umask (again).</issue_description>

Comments on the Issue (you are @copilot in this section)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Fix umask</issue_title>
<issue_description>We seem to be back to 022 for the umask. This breaks local logging.

Step 1: add chmod -R g+w web/sites/default/files to uceap refresh-content as temporary workaround

Step 2: fix the umask (again).</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Fix umask #40

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[kurowski]

i don't see UMASK in /etc/login.defs anymore. perhaps it was moved in between debian 12 (our original base image) and debian 13 (which we recently upgraded to)?

[Copilot]

Good catch! I've updated the approach to configure pam_umask directly instead of relying on /etc/login.defs. The new implementation sets umask=002 as a parameter to pam_umask.so in the PAM configuration files (/etc/pam.d/common-session and /etc/pam.d/common-session-noninteractive), which works regardless of whether UMASK exists in /etc/login.defs. This makes it compatible with both Debian 12 and 13. (67e626a)