On my Linux Mint 19.1:
```bash
$ umask
0022
```

After the first run of `bitcoin-qt -sysperm=false` the `0700` permissions are expected for both the datadir (`~/.bitcoin`) and the walletdir (`~/.bitcoin/wallets`).

Actually, the directories are created with such access permissions:
```bash
$ stat ~/.bitcoin | grep Uid
Access: (0755/drwxr-xr-x)  Uid: ( 1000/ hebasto)   Gid: ( 1000/ hebasto)
$ stat ~/.bitcoin/wallets | grep Uid
Access: (0755/drwxr-xr-x)  Uid: ( 1000/ hebasto)   Gid: ( 1000/ hebasto)
```

Refs:
- #4286
- #13371
- #13389

NOTE: reading through the initial PR #4286 makes me think it was controversial. Is it a better and simpler way to just get rid of `-sysperm` option? I believe a user who needs this option can easily run `chown` command.
if (use_syscall_sandbox) {
            SetSyscallSandboxPolicy(SyscallSandboxPolicy::INITIALIZATION);
        }
        LogPrintf("Experimental syscall sandbox enabled (-sandbox=%s): bitcoind will terminate if an unexpected (not allowlisted) syscall is invoked.\n", sandbox_arg);
    }
#endif 
    
    {
        ChainstateManager::Options chainman_opts_dummy{
            .chainparams = chainparams,
        };
        if (const auto error{ApplyArgsManOptions(args, chainman_opts_dummy)}) {
            return InitError(*error);
        }
    }
    return true;
}
static bool LockDataDirectory(bool probeOnly)
{
    
    const fs::path& datadir = gArgs.GetDataDirNet();
    if (!DirIsWritable(datadir)) {
        return InitError(strprintf(_("Cannot write to data directory '%s'; check permissions."), fs::PathToString(datadir)));
    }
    if (!LockDirectory(datadir, ".lock", probeOnly)) {
        return InitError(strprintf(_("Cannot obtain a lock on data directory %s. %s is probably already running."), fs::PathToString(datadir), PACKAGE_NAME));
    }
    return true;
}
bool AppInitSanityChecks(const kernel::Context& kernel)