Is there a way to set the umask for the pip state module or is there a more generic way to set the umask before specific state modules are run? In ansible the pip module takes a umask parameter. I do not see an equivalent option in the salt pip state module. We run salt-call with a umask of 007 but we need to install certain python packages with more open permissions; is there a way to do this?

2 Answers 2


Edit update April 3rd 2023:

As of salt 3006 (https://salt.tips/whats-new-in-salt-sulfur/#umask) umask is now a global state argument and can be specified on any state.

Original work around for pre 3006

I ended up working around this by creating a custom state module that wraps any state that I want to set the umask for:


import os

def wrap(wrapped_state, mask, *args, **kwargs):
    old_umask = None
        if not __opts__["test"]:
            old_umask = os.umask(int(mask, base=8))
        return __states__[wrapped_state](*args, **kwargs)
        if old_umask is not None:


"install python requests package":
    - wrapped_state: pip.installed
    - mask: '022'
    - name: requests

This answer is for versions <3006

No, there's no facility for changing the umask of the running Salt process.

What you could do is start a new process with cmd.run:

install python module:
    - name: pip install foo
    - umask: '077'
    - unless:
      - fun: pip.is_installed
        pkgname: foo

install python module at version:
    - name: pip install bar==4.2
    - umask: '077'
    - unless:
      - pip freeze | grep bar==4.2
  • Is there a way to specify a specific version and/or a >= version to the pip.is_installed function?
    – bdrx
    Sep 12, 2022 at 14:46
  • @bdrx no, but see edit
    – OrangeDog
    Sep 12, 2022 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.