How to set umask for a specific user, globally?

I've set up a DAC sandbox for Firefox - just an extra limited user account, in its own group (and no other groups). I'd like to be able to create and delete files in the sandbox user's home, i.e. permissions o=rw. But I would like to do that on a global basis - from /etc/profile or such, not from the user's home directory. Furthermore I would like to make the sandbox user unable to change its own umask.

Is this possible?

 

umask is a shell builtin, so the only way to impose this, either through mount options or filesystem options, but depends what filesystem you're using. Note this could break things.
Mrk

 

I was afraid that would be the answer. Thanks though... I guess I'll just use the .profile method, and remember to 'su -' instead of 'su'.

(BTW is it just me or should 'su -' really be the default? I'm pretty sure there are problems with elevating to root while preserving the user's environment variables.)