On my Linux Mint 19.1:
```bash
$ umask
0022
```

After the first run of `bitcoin-qt -sysperm=false` the `0700` permissions are expected for both the datadir (`~/.bitcoin`) and the walletdir (`~/.bitcoin/wallets`).

Actually, the directories are created with such access permissions:
```bash
$ stat ~/.bitcoin | grep Uid
Access: (0755/drwxr-xr-x)  Uid: ( 1000/ hebasto)   Gid: ( 1000/ hebasto)
$ stat ~/.bitcoin/wallets | grep Uid
Access: (0755/drwxr-xr-x)  Uid: ( 1000/ hebasto)   Gid: ( 1000/ hebasto)
```

Refs:
- #4286
- #13371
- #13389

NOTE: reading through the initial PR #4286 makes me think it was controversial. Is it a better and simpler way to just get rid of `-sysperm` option? I believe a user who needs this option can easily run `chown` command.
return InitError(_("-reindex-chainstate option is not compatible with -txindex. Please temporarily disable txindex while using -reindex-chainstate, or replace -reindex-chainstate with -reindex to fully rebuild all indexes."));
        }
    }
#if defined(USE_SYSCALL_SANDBOX)
    if (args.IsArgSet("-sandbox") && !args.IsArgNegated("-sandbox")) {
        const std::string sandbox_arg{args.GetArg("-sandbox", "")};
        bool log_syscall_violation_before_terminating{false};
        if (sandbox_arg == "log-and-abort") {
            log_syscall_violation_before_terminating = true;
        } else if (sandbox_arg == "abort") {
            
        } else {
            return InitError(Untranslated("Unknown syscall sandbox mode (-sandbox=<mode>). Available modes are \"log-and-abort\" and \"abort\"."));
        }
        
        const std::vector<std::string> features_using_execve{
            "-alertnotify",
            "-blocknotify",
            "-signer",
            "-startupnotify",
            "-walletnotify",
        };
        for (const std::string& feature_using_execve : features_using_execve) {
            if (!args.GetArg(feature_using_execve, "").empty()) {
                return InitError(Untranslated(strprintf("The experimental syscall sandbox feature (-sandbox=<mode>) is incompatible with %s (which uses execve).", feature_using_execve)));
            }
        }
        if (!SetupSyscallSandbox(log_syscall_violation_before_terminating)) {
            return InitError(Untranslated("Installation of the syscall sandbox failed."));
        }