On my Linux Mint 19.1:
```bash
$ umask
0022
```

After the first run of `bitcoin-qt -sysperm=false` the `0700` permissions are expected for both the datadir (`~/.bitcoin`) and the walletdir (`~/.bitcoin/wallets`).

Actually, the directories are created with such access permissions:
```bash
$ stat ~/.bitcoin | grep Uid
Access: (0755/drwxr-xr-x)  Uid: ( 1000/ hebasto)   Gid: ( 1000/ hebasto)
$ stat ~/.bitcoin/wallets | grep Uid
Access: (0755/drwxr-xr-x)  Uid: ( 1000/ hebasto)   Gid: ( 1000/ hebasto)
```

Refs:
- #4286
- #13371
- #13389

NOTE: reading through the initial PR #4286 makes me think it was controversial. Is it a better and simpler way to just get rid of `-sysperm` option? I believe a user who needs this option can easily run `chown` command.
for (const auto& net : args.GetArgs("-whitelist")) {
        NetWhitelistPermissions subnet;
        bilingual_str error;
        if (!NetWhitelistPermissions::TryParse(net, subnet, error)) return InitError(error);
        connOptions.vWhitelistedRange.push_back(subnet);
    }
    connOptions.vSeedNodes = args.GetArgs("-seednode");
     Initiate outbound connections unless connect=0
    connOptions.m_use_addrman_outgoing = !args.IsArgSet("-connect");
    if (!connOptions.m_use_addrman_outgoing) {
        const auto connect = args.GetArgs("-connect");
        if (connect.size() != 1 || connect[0] != "0") {
            connOptions.m_specified_outgoing = connect;
        }
    }
    const std::string& i2psam_arg = args.GetArg("-i2psam", "");
    if (!i2psam_arg.empty()) {
        CService addr;
        if (!Lookup(i2psam_arg, addr, 7656, fNameLookup) || !addr.IsValid()) {
            return InitError(strprintf(_("Invalid -i2psam address or hostname: '%s'"), i2psam_arg));
        }
        SetProxy(NET_I2P, Proxy{addr});
    } else {
        if (args.IsArgSet("-onlynet") && IsReachable(NET_I2P)) {
            return InitError(
                _("Outbound connections restricted to i2p (-onlynet=i2p) but "
                  "-i2psam is not provided"));
        }
        SetReachable(NET_I2P, false);
    }