In recent versions of OS X (10.6+), the sudo command by default takes the "union" (bitwise or) of 0022 and the caller's user mask. This can lead to problems if the umask is more restrictive than 0022: e.g., the caller may not be able to access files created by sudo. The related post, How do I tell sudo to write files with a umask of 0022?, gives a few options; namely this answer tells us that in 10.7+, we can simply add two lines to the /etc/sudoers file:
Defaults umask_override
Defaults umask=0022
For me, this fixes the issue (i.e. uses umask 0022) for sudo, but not when switching to root via the su command (I'm running OS X 10.7.5).
Question: How do you configure OX X (versions 10.7+) to use a umask of 0022 when switching to the root user via su, regardless of the caller's umask?
I would prefer a solution that doesn't simply redefine the su command. Note that man sudoers suggests the PAM configuration might be related:
umask: Umask to use when running the command. Negate this option or set it to 0777 to
preserve the user's umask. The actual umask that is used will be the union of the
user's umask and 0022. This guarantees that sudo never lowers the umask when running
a command. Note on systems that use PAM, the default PAM configuration may specify
its own umask which will override the value set in sudoers.
Thanks!
