NTFS:

Make all files executable by default, {u,f,d}mask mount options can be
used to take away executable bit if desired.
Also make default umask match the documentation (i.e. 0077).

Documentation/filesystems/ntfs.txt

@@ -35,8 +35,13 @@ uid=
 gid=
 umask=			Provide default owner, group, and access mode mask.
 			These options work as documented in mount(8). By
-			default, the files are owned by root and are not
-			readable by anyone else.
+			default, the files/directories are owned by root and
+			he/she has read, write, and execute permissions. No one
+			else has any access permissions. I.e. the mode on all
+			files and directories is by default rwx------, a
+			consequence of the default umask=0077. Using a
+			umask of zero will grant all permissions to everyone,
+			i.e. all files and directories will have mode rwxrwxrwx.
 
 fmask=
 dmask=			Instead of specifying umask which applies both to

fs/ntfs/inode.c

@@ -759,15 +759,13 @@ void ntfs_read_inode(struct inode *vi)
 				le32_to_cpu(ctx->attr->_ARA(value_length));
 		}
 no_data_attr_special_case:
-		/* Everyone gets read permissions. */
-		vi->i_mode |= S_IRUGO;
-		/* If not read-only, set write permissions. */
-		if (!IS_RDONLY(vi))
-			vi->i_mode |= S_IWUGO;
+		/* Everyone gets all permissions. */
+		vi->i_mode |= S_IRWXUGO;
+		/* If read-only, noone gets write permissions. */
+		if (IS_RDONLY(vi))
+			vi->i_mode &= ~S_IWUGO;
 		/* Apply the file permissions mask set in the mount options. */
 		vi->i_mode &= ~vol->fmask;
-		// FIXME: Encrypted files should probably get their rw bits
-		// taken away here.
 		/* Setup the operations for this inode. */
 		vi->i_op = &ntfs_file_inode_ops;
 		vi->i_fop = &ntfs_file_ops;

fs/ntfs/super.c

@@ -1524,11 +1524,10 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
 	vol->nls_map = NULL;
 
 	/*
-	 * Default is group and other don't have write/execute access to files
-	 * and write access to directories.
+	 * Default is group and other don't have any access to files or
+	 * directories while owner has full access.
 	 */
-	vol->fmask = 0033;
-	vol->dmask = 0022;
+	vol->fmask = vol->dmask = 0077;
 
 	/*
 	 * Default is to show long file names (including POSIX file names), and