Hi -
In all current stable versions of MongoDB, the server writes files in accordance with your umask, though some files are opened O_CREAT with more restrictive permissions set. More recently, on the master branch, that has changed per
SERVER-22829. As of the resolution of that ticket, server processes update the umask to remove group and other permissions by default, unless overridden by passing
--setParameter=honorSystemUmask=true at startup.
For the stable releases, if you would like to tighten the permissions given to created files, it should be sufficient to simply update your umask in your shell before starting mongod or mongos. Alternatively, if you are using an init script or similar, you can probably update that to similarly set a more restrictive umask.
Thanks,
Andrew