In recent versions of OS X (10.6+), the
sudo command by default takes the "union" (bitwise or) of 0022 and the caller's user mask. This can lead to problems if the umask is more restrictive than 0022: e.g., the caller may not be able to access files created by sudo. The related post, How do I tell sudo to write files with a umask of 0022?, gives a few options; namely this answer tells us that in 10.7+, we can simply add two lines to the
Defaults umask_override Defaults umask=0022
For me, this fixes the issue (i.e. uses umask 0022) for
sudo, but not when switching to root via the
su command (I'm running OS X 10.7.5).
Question: How do you configure OX X (versions 10.7+) to use a umask of 0022 when switching to the root user via
su, regardless of the caller's umask?
I would prefer a solution that doesn't simply redefine the
su command. Note that
man sudoers suggests the PAM configuration might be related:
umask: Umask to use when running the command. Negate this option or set it to 0777 to preserve the user's umask. The actual umask that is used will be the union of the user's umask and 0022. This guarantees that sudo never lowers the umask when running a command. Note on systems that use PAM, the default PAM configuration may specify its own umask which will override the value set in sudoers.