umask is very relevant.
According to mkdir(2) system call man page (which is what
CreateDirectory ultimately does),
The directory path is created with the access permissions specified by
mode and restricted by the umask(2) of the calling process.
As mentioned in the question, the default mode is 0777. We can check the effect of
umask -- this being OS X, it's best seen by running a standalone kernel from a terminal, so that the
umask gets properly inherited from the parent process (
$ umask 0123
Mathematica 10.3.0 for Mac OS X x86 (64-bit)
Copyright 1988-2015 Wolfram Research, Inc.
In:= d = CreateDirectory["/tmp/foo"];
In:= ReadString[StringJoin["!ls -ld ", d]]
Out= "drw-r-xr-- 2 iliang wheel 68 Oct 29 17:31 /tmp/foo"
(note: I used OS X 10.10 in the above example. With OS X 10.11, the result would be as if
umask had not been set)
As for what happens when using the notebook interface (i.e. the kernel is launched by the frontend), there probably are ways to set a
umask for GUI programs on OS X, but I wasn't really tempted to try them: SquareOne's suggestion to use something like
Run["mkdir -m u=rwx,g=,o= /tmp/dir"]
works just fine.