diff --git a/etc/pam.d/common-session-noninteractive b/etc/pam.d/common-session-noninteractive
index c9144d5..699391f 100644
--- a/etc/pam.d/common-session-noninteractive
+++ b/etc/pam.d/common-session-noninteractive
@@ -21,5 +21,6 @@ session	requisite			pam_deny.so
 # since the modules above will each just jump around
 session	required			pam_permit.so
 # and here are more per-package modules (the "Additional" block)
-session	required	pam_unix.so 
+session	required	pam_unix.so
+session optional  pam_umask.so usergroups
 # end of pam-auth-update config