diff --git a/hadoop-yarn-project/CHANGES.txt b/hadoop-yarn-project/CHANGES.txt
index d542069b04b..3515ae06c56 100644
--- a/hadoop-yarn-project/CHANGES.txt
+++ b/hadoop-yarn-project/CHANGES.txt
@@ -78,3 +78,5 @@ Release 0.23.3 - Unreleased
 
     YARN-60. Fixed a bug in ResourceManager which causes all NMs to get NPEs and
     thus causes all containers to be rejected. (vinodkv)
+
+    YARN-66. aggregated logs permissions not set properly (tgraves via bobby)
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/logaggregation/AggregatedLogFormat.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/logaggregation/AggregatedLogFormat.java
index 407fc9ca26e..008324f013a 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/logaggregation/AggregatedLogFormat.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/logaggregation/AggregatedLogFormat.java
@@ -48,6 +48,7 @@ import org.apache.hadoop.fs.FSDataOutputStream;
 import org.apache.hadoop.fs.FileContext;
 import org.apache.hadoop.fs.Options;
 import org.apache.hadoop.fs.Path;
+import org.apache.hadoop.fs.permission.FsPermission;
 import org.apache.hadoop.io.Writable;
 import org.apache.hadoop.io.file.tfile.TFile;
 import org.apache.hadoop.security.UserGroupInformation;
@@ -68,6 +69,13 @@ public class AggregatedLogFormat {
   //Maybe write out a list of containerLogs skipped by the retention policy.
   private static final int VERSION = 1;
 
+  /**
+   * Umask for the log file.
+   */
+  private static final FsPermission APP_LOG_FILE_UMASK = FsPermission
+      .createImmutable((short) (0640 ^ 0777));
+
+
   static {
     RESERVED_KEYS = new HashMap<String, AggregatedLogFormat.LogKey>();
     RESERVED_KEYS.put(APPLICATION_ACL_KEY.toString(), APPLICATION_ACL_KEY);
@@ -194,7 +202,9 @@ public class AggregatedLogFormat {
             userUgi.doAs(new PrivilegedExceptionAction<FSDataOutputStream>() {
               @Override
               public FSDataOutputStream run() throws Exception {
-                return FileContext.getFileContext(conf).create(
+                FileContext fc = FileContext.getFileContext(conf);
+                fc.setUMask(APP_LOG_FILE_UMASK);
+                return fc.create(
                     remoteAppLogFile,
                     EnumSet.of(CreateFlag.CREATE, CreateFlag.OVERWRITE),
                     new Options.CreateOpts[] {});
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/test/java/org/apache/hadoop/yarn/logaggregation/TestAggregatedLogFormat.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/test/java/org/apache/hadoop/yarn/logaggregation/TestAggregatedLogFormat.java
index ea8c8f79c5f..de755a72156 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/test/java/org/apache/hadoop/yarn/logaggregation/TestAggregatedLogFormat.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/test/java/org/apache/hadoop/yarn/logaggregation/TestAggregatedLogFormat.java
@@ -32,7 +32,9 @@ import junit.framework.Assert;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.FileSystem;
+import org.apache.hadoop.fs.permission.FsPermission;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.security.UserGroupInformation;
 import org.apache.hadoop.yarn.api.records.ContainerId;
@@ -100,6 +102,11 @@ public class TestAggregatedLogFormat {
     logWriter.append(logKey, logValue);
     logWriter.closeWriter();
 
+    // make sure permission are correct on the file
+    FileStatus fsStatus =  fs.getFileStatus(remoteAppLogFile);
+    Assert.assertEquals("permissions on log aggregation file are wrong",  
+      FsPermission.createImmutable((short) 0640), fsStatus.getPermission()); 
+
     LogReader logReader = new LogReader(conf, remoteAppLogFile);
     LogKey rLogKey = new LogKey();
     DataInputStream dis = logReader.next(rLogKey);
@@ -123,6 +130,7 @@ public class TestAggregatedLogFormat {
     
     Assert.assertEquals(expectedLength, s.length());
   }
+
   
   private void writeSrcFile(Path srcFilePath, String fileName, long length)
       throws IOException {