diff --git a/authfs/fd_server/src/main.rs b/authfs/fd_server/src/main.rs
index f5a3cba..f17b7e8 100644
--- a/authfs/fd_server/src/main.rs
+++ b/authfs/fd_server/src/main.rs
@@ -28,7 +28,7 @@
 use anyhow::{bail, Result};
 use binder_common::rpc_server::run_rpc_server;
 use log::debug;
-use nix::dir::Dir;
+use nix::{dir::Dir, sys::stat::umask, sys::stat::Mode};
 use std::collections::BTreeMap;
 use std::fs::File;
 use std::os::unix::io::FromRawFd;
@@ -157,10 +157,15 @@
     );
 
     let args = parse_args()?;
+
+    // Allow open/create/mkdir from authfs to create with expecting mode. It's possible to still
+    // use a custom mask on creation, then report the actual file mode back to authfs. But there
+    // is no demand now.
+    let old_umask = umask(Mode::empty());
+    debug!("Setting umask to 0 (old: {:03o})", old_umask.bits());
+
     let service = FdService::new_binder(args.fd_pool).as_binder();
-
     debug!("fd_server is starting as a rpc service.");
-
     let mut ready_fd = args.ready_fd;
     let retval = run_rpc_server(service, RPC_SERVICE_PORT, || {
         debug!("fd_server is ready");
diff --git a/compos/common/compos_client.rs b/compos/common/compos_client.rs
index 6c16bb0..9c23fac 100644
--- a/compos/common/compos_client.rs
+++ b/compos/common/compos_client.rs
@@ -87,14 +87,17 @@
             .context("Failed to open config APK idsig file")?;
         let idsig_fd = ParcelFileDescriptor::new(idsig_fd);
 
-        let (log_fd, debug_level) = if parameters.debug_mode {
-            // Console output and the system log output from the VM are redirected to this file.
-            let log_fd =
-                File::create(data_dir.join("vm.log")).context("Failed to create log file")?;
+        let (console_fd, log_fd, debug_level) = if parameters.debug_mode {
+            // Console output and the system log output from the VM are redirected to file.
+            let console_fd = File::create(data_dir.join("vm_console.log"))
+                .context("Failed to create console log file")?;
+            let log_fd = File::create(data_dir.join("vm.log"))
+                .context("Failed to create system log file")?;
+            let console_fd = ParcelFileDescriptor::new(console_fd);
             let log_fd = ParcelFileDescriptor::new(log_fd);
-            (Some(log_fd), DebugLevel::FULL)
+            (Some(console_fd), Some(log_fd), DebugLevel::FULL)
         } else {
-            (None, DebugLevel::NONE)
+            (None, None, DebugLevel::NONE)
         };
 
         let config_path = parameters.config_path.as_deref().unwrap_or(DEFAULT_VM_CONFIG_PATH);
@@ -108,7 +111,7 @@
         });
 
         let vm = service
-            .createVm(&config, log_fd.as_ref(), log_fd.as_ref())
+            .createVm(&config, console_fd.as_ref(), log_fd.as_ref())
             .context("Failed to create VM")?;
         let vm_state = Arc::new(VmStateMonitor::default());