diff --git a/lib/fluent/plugin/buf_file.rb b/lib/fluent/plugin/buf_file.rb
index 58d6b10722..653990b337 100644
--- a/lib/fluent/plugin/buf_file.rb
+++ b/lib/fluent/plugin/buf_file.rb
@@ -23,11 +23,16 @@
 
 module Fluent
   class FileBufferChunk < BufferChunk
+    include SystemConfigMixin
+
+    FILE_PERMISSION = 0644
+
     def initialize(key, path, unique_id, mode="a+", symlink_path = nil)
       super(key)
       @path = path
       @unique_id = unique_id
-      @file = File.open(@path, mode, DEFAULT_FILE_PERMISSION)
+      @file_permission = system_config.file_permission || FILE_PERMISSION
+      @file = File.open(@path, mode, @file_permission)
       @file.binmode
       @file.sync = true
       @size = @file.stat.size
@@ -78,7 +83,7 @@ def mv(path)
         @file.close
         File.rename(@path, path)
         @path = path
-        @file = File.open(@path, 'rb', DEFAULT_FILE_PERMISSION)
+        @file = File.open(@path, 'rb', @file_permission)
         @file.sync = true
         @size = @file.size
         @file.pos = pos
@@ -91,8 +96,12 @@ def mv(path)
   end
 
   class FileBuffer < BasicBuffer
+    include SystemConfigMixin
+
     Plugin.register_buffer('file', self)
 
+    DIR_PERMISSION = 0755
+
     @@buffer_paths = {}
 
     def initialize
@@ -129,10 +138,11 @@ def configure(conf)
         @buffer_path_suffix = ".log"
       end
 
+      @dir_perm = system_config.dir_permission || DIR_PERMISSION
     end
 
     def start
-      FileUtils.mkdir_p File.dirname(@buffer_path_prefix + "path"), mode: DEFAULT_DIR_PERMISSION
+      FileUtils.mkdir_p File.dirname(@buffer_path_prefix + "path"), mode: @dir_perm
       super
     end
 
diff --git a/test/plugin/test_buf_file.rb b/test/plugin/test_buf_file.rb
index 2da05d16a8..39566c7737 100644
--- a/test/plugin/test_buf_file.rb
+++ b/test/plugin/test_buf_file.rb
@@ -2,6 +2,7 @@
 require_relative '../helper'
 require 'fluent/test'
 require 'fluent/plugin/buf_file'
+require 'fluent/system_config'
 
 require 'fileutils'
 
@@ -47,6 +48,47 @@ def test_init
       File.unlink(symlink_path)
     end
 
+    class TestWithSystem < self
+      include Fluent::SystemConfigMixin
+
+      OVERRIDE_FILE_PERMISSION = 0620
+      CONFIG_SYSTEM = %[
+        <system>
+          file_permission #{OVERRIDE_FILE_PERMISSION}
+        </system>
+      ]
+
+      def parse_system(text)
+        basepath = File.expand_path(File.dirname(__FILE__) + '/../../')
+        Fluent::Config.parse(text, '(test)', basepath, true).elements.find { |e| e.name == 'system' }
+      end
+
+      def setup
+        omit "NTFS doesn't support UNIX like permissions" if Fluent.windows?
+        # Store default permission
+        @default_permission = system_config.instance_variable_get(:@file_permission)
+      end
+
+      def teardown
+        # Restore default permission
+        system_config.instance_variable_set(:@file_permission, @default_permission)
+      end
+
+      def test_init_with_system
+        system_conf = parse_system(CONFIG_SYSTEM)
+        sc = Fluent::SystemConfig.new(system_conf)
+        Fluent::Engine.init(sc)
+        chunk = filebufferchunk('key', 'init3')
+        assert_equal 'key', chunk.key
+        assert_equal 'init3', chunk.unique_id
+        assert_equal bufpath('init3'), chunk.path
+        mode = "%o" % File.stat(chunk.path).mode
+        assert_equal OVERRIDE_FILE_PERMISSION, mode[-3, 3].to_i
+
+        chunk.close # size==0, then, unlinked
+      end
+    end
+
     def test_buffer_chunk_interface
       chunk = filebufferchunk('key', 'interface1')
 
@@ -597,5 +639,52 @@ def test_resume_only_for_my_buffer_path
       # We will fix it in next API version of buffer plugin.
       assert_equal 1, map.size
     end
+
+    class TestWithSystem < self
+      include Fluent::SystemConfigMixin
+
+      OVERRIDE_DIR_PERMISSION = 720
+      CONFIG_WITH_SYSTEM = %[
+        <system>
+          dir_permission #{OVERRIDE_DIR_PERMISSION}
+        </system>
+      ]
+
+      def setup_system_config
+        system_conf = parse_system(CONFIG_WITH_SYSTEM)
+        sc = Fluent::SystemConfig.new(system_conf)
+        Fluent::Engine.init(sc)
+      end
+
+      def setup
+        omit "NTFS doesn't support UNIX like permissions" if Fluent.windows?
+        setup_system_config
+        FileUtils.rm_rf(BUF_FILE_TMPDIR, secure: true)
+      end
+
+      def parse_system(text)
+        basepath = File.expand_path(File.dirname(__FILE__) + '/../../')
+        Fluent::Config.parse(text, '(test)', basepath, true).elements.find { |e| e.name == 'system' }
+      end
+
+      def test_new_chunk
+        buf = Fluent::FileBuffer.new
+        buf.configure({'buffer_path' => bufpath('new_chunk_1')})
+        prefix = buf.instance_eval{ @buffer_path_prefix }
+        suffix = buf.instance_eval{ @buffer_path_suffix }
+
+        # To create buffer directory
+        buf.start
+
+        chunk = buf.new_chunk('key1')
+        assert chunk
+        assert File.exists?(chunk.path)
+        assert chunk.path =~ /\A#{prefix}[-_.a-zA-Z0-9\%]+\.b[0-9a-f]+#{suffix}\Z/, "path from new_chunk must be a 'b' buffer chunk"
+        chunk.close
+
+        mode = "%o" % File.stat(BUF_FILE_TMPDIR).mode
+        assert_equal(OVERRIDE_DIR_PERMISSION, mode[-3, 3].to_i)
+      end
+    end
   end
 end