Configure some fields through args

main.py

@@ -73,7 +73,32 @@ def main():
         type=Path,
         help="A file containing group names to ignore (one group name per line).",
         required=False,
-        metavar="IGNORE_GROUP_FILE",
+        metavar="PATH",
+    )
+
+    parser.add_argument(
+        "--set-default-umask",
+        type=str,
+        help="Set the umask for all users.",
+        metavar='OCTAL',
+    )
+    parser.add_argument(
+        "--set-default-mount-no-devices",
+        type=bool,
+        help="Set mountNoDevices for all users.",
+        metavar='BOOL',
+    )
+    parser.add_argument(
+        "--set-default-mount-no-suid",
+        type=bool,
+        help="Set mountNoSuid for all users.",
+        metavar='BOOL',
+    )
+    parser.add_argument(
+        "--set-default-mount-no-execute",
+        type=bool,
+        help="Set mountNoExecute for all users.",
+        metavar='BOOL',
     )
 
     args = parser.parse_args()
@@ -228,16 +253,25 @@ class User:
     home: str
     shell: str
 
+    # GECOS fields
     full_name: str | None = None
     location: str | None = None
     work_phone: str | None = None
     home_phone: str | None = None
     other: str | None = None
 
+    # Computed fields
     memberOf: list[str] | None = None
     email: str | None = None
     is_admin: bool = False
 
+    # Fields passed from args
+    umask: str | None = None
+    mount_no_devices: bool | None = None
+    mount_no_suid: bool | None = None
+    mount_no_execute: bool | None = None
+
+    # Privileged fields
     password: str | None = None
     password_last_change: int | None = None
     password_min_days: int | None = None
@@ -311,17 +345,22 @@ class User:
             "realName": self.full_name,
             "disposition": self.get_disposition(),
             "shell": self.shell,
-            "umask": "0022",
             "locked": self.get_locked(),
             "storage": "classic",
             "uid": self.uid,
             "gid": self.gid,
             "homeDirectory": self.home,
-            # "mountNoDevices": True,
-            # "mountNoSuid": True,
-            # "mountNoExecute": False,
         }
 
+        if self.umask:
+            result["umask"] = self.umask
+        if self.mount_no_devices is not None:
+            result["mountNoDevices"] = self.mount_no_devices
+        if self.mount_no_suid is not None:
+            result["mountNoSuid"] = self.mount_no_suid
+        if self.mount_no_execute is not None:
+            result["mountNoExecute"] = self.mount_no_execute
+
         if self.email:
             result["emailAddress"] = self.email
         if self.location: