Services should run with UMask of 0027 or more restrictive.

[kresss]

Describe the enhancement:
Change the services files for example the systemd unit file to set an explicit UMask. For example a umask of 0077.

Describe a specific use case for the enhancement or feature:

On RHEL systems using Beats with Systemd Services start with a default umask of 0022. If a file is created by the service the file is by default world readable with this umask. Given the nature of beats and the fact that they are often used to process logging data or sensitive data they should write all files without world readable permissions. This is especially a problem when beats are configured to log to their own log file.