In order to allow mariabackup to run under an ID other than "mysql" we need to create a backup ID and place it in the same group as mysql. However, when new databases are created, the directories and files are created without read/execute for the group ID. Thus, upon any new database creation, mariabackup starts failing.

Currently, the only way to set UMASK_DIR on startup is to edit the service file, and these edits get overwritten any time an upgrade is installed. There's a way to set up an override file, but this type of configuration shouldn't be so esoteric. It should be as simple as setting the parameter in server.cnf, the way we do with most others.