I am working on a new site using the latest release C5-8.3.2
This site is running on a brand new VM web server running Ubuntu 16.04 (fully patched), using nginx, PHP 7.0 with fpm
The install went perfectly as expected, permissions on the web root tree
chown -R www-data:www-data
chmod -R 775
All of this is the same setup I use for all of my development builds. These servers are behind a firewall and not accessible from the internet.

At this point, its a vanilla install with no mods or changes.
When I generate the sitemap from the Jobs page it all works ok

when I run it like this
/var/www/vhosts/cachewarmer/httpdocs/concrete/bin/concrete5 c5:job generate_sitemap

First I got an error /application/files/cache/expensive write protected, There were files in there which must have been the web server.
I applied 777 to that folder and got a different error
unable to write to protected sitemap.xml

I applied 777 to the sitemap and it worked.

on the same web server a c5-8.2.1 build, this works perfectly with 775.

Is this a config issue or a bug?

A few points, I didn't try the HTTP route to running Generate Sitemap, this was merely a test, I run all of my cron jobs in this way and is one of several tests I do on a new server and cms versions. The server was built by me from a script I use to build all of my web servers, it was built immediately prior to this test.
I did repeat these tests on a web server that was built 6 months ago with the same results.
and destroyed the original web server and repeated the tests to make sure I wasn't missing something. Currently, I am unable to deploy this build and will have to switch back to C5-8.2.1.

Thanks
Martyn

An Update
I have found that by running the call with sudo
sudo /var/www/vhosts/cachewarmer1/httpdocs/concrete/bin/concrete5 c5:job generate_sitemap

This does work.
while on the 8.2.1 build it doesnt require sudo.