--- a/usr/src/cmd/installadm/create_service.py	Tue May 15 13:06:18 2012 -0700
+++ b/usr/src/cmd/installadm/create_service.py	Wed May 16 16:31:20 2012 +0200
@@ -391,7 +391,12 @@
                 raise SystemExit(error)
         else:
             try:
+                # This directory need to have at least o+x permission.
+                orig_umask = os.umask(00)
+                modified_umask = orig_umask & 0776
+                os.umask(modified_umask)
                 os.makedirs(BASE_IMAGE_DIR)
+                os.umask(orig_umask)
             except OSError as err:
                 if err.errno != errno.EEXIST:
                     raise

--- a/usr/src/cmd/installadm/image.py	Tue May 15 13:06:18 2012 -0700
+++ b/usr/src/cmd/installadm/image.py	Wed May 16 16:31:20 2012 +0200
@@ -158,7 +158,12 @@
         '''
         self._remove_ai_webserver_symlink()
         try:
+            # This directory need to have at least o+x permission.
+            orig_umask = os.umask(00)
+            modified_umask = orig_umask & 0776
+            os.umask(modified_umask)
             os.makedirs(os.path.dirname(new_path))
+            os.umask(orig_umask)
         except OSError as err:
             if err.errno != errno.EEXIST:
                 raise
@@ -236,7 +241,12 @@
         '''Enable the AI webserver to access the image path'''
         target_path = os.path.dirname(self.path).lstrip("/")
         try:
+            # This directory need to have at least o+x permission.
+            orig_umask = os.umask(00)
+            modified_umask = orig_umask & 0776
+            os.umask(modified_umask)
             os.makedirs(os.path.join(com.WEBSERVER_DOCROOT, target_path))
+            os.umask(orig_umask)
         except OSError as err:
             if err.errno != errno.EEXIST:
                 raise

--- a/usr/src/cmd/installadm/service_config.py	Tue May 15 13:06:18 2012 -0700
+++ b/usr/src/cmd/installadm/service_config.py	Wed May 16 16:31:20 2012 +0200
@@ -760,7 +760,14 @@
 
     svcdir = os.path.join(AI_SERVICE_DIR_PATH, service_name)
     try:
+        # These directories need to have at least o+x permission because
+        # cgi_get_manifest.py script which is run as webservd user reads
+        # .config file there.
+        orig_umask = os.umask(00)
+        modified_umask = orig_umask & 0776
+        os.umask(modified_umask)
         os.makedirs(svcdir)
+        os.umask(orig_umask)
     except OSError as err:
         if err.errno != errno.EEXIST:
             raise