Bug 291

The line:

Defaults   !umask

in sudoers will prevent sudo from changing the umask.  However, something else (perhaps PAM) may be changing it.

What the documentation means is that if "umask 0777" is specified, sudo will not change the umask itself, which is equivalent to "!umask".

You can try running configure with the --disable-pam-session flag which will prevent sudo from using PAM's session support, which is probably where the umask change is coming from.  Alternately, you could investigate your PAM configuration and change the umask settings there.

Sorry, that should be "sudo -i -H -u testuser"

I've just deployed sudo 1.6.9p16 across various HPUX systems, upgrading from sudo 1.6.8p4 on PARISC 11.23, and from sudo 1.6.8p12 on Itanium 11.23/11.31.  This sudo build is from HP's Internet Express suite.

It seems with 1.6.9p16 the umask setting in sudoers is ignored; files from the sudo'd command are being created under umask 077 regardless of the sudoers umask setting (eg !umask, umask=0022, umask=0777).

I only have the 'sudo -V' output from 1.6.8p12 to compare...PAM was then and is now being used as the Authentication method (below).

Could someone please take another look at this?

Thanks.

# sudo -V
Sudo version 1.6.8p12

Authentication methods: 'pam'
Syslog facility if syslog is being used for logging: local2
Syslog priority to use when user authenticates successfully: notice
Syslog priority to use when user authenticates unsuccessfully: alert
Send mail if the user is not in sudoers
Lecture user the first time they run sudo
Require users to authenticate by default
Root may run sudo
Log the hostname in the (non-syslog) log file
Allow some information gathering to give useful error messages
Require fully-qualified hostnames in the sudoers file
Set the LOGNAME and USER environment variables
Length at which to wrap log file lines (0 for no wrap): 80
Authentication timestamp timeout: 5 minutes
Password prompt timeout: 5 minutes
Number of tries to enter a password: 3
Umask to use or 0777 to use user's: 022
Path to mail program: /usr/sbin/sendmail
Flags for mail program: -t
Address to send mail to: root
Subject line for mail messages: *** SECURITY information for %h ***
Incorrect password message: Sorry, try again.
Path to authentication timestamp dir: /var/run/sudo
Default password prompt: Password:
Default user to run commands as: root
Path to the editor for use by visudo: /usr/bin/vi
When to require a password for 'list' pseudocommand: any
When to require a password for 'verify' pseudocommand: all
File containing dummy exec functions: /opt/iexpress/sudo/libexec/sudo_noexec.so
Environment variables to check for sanity:
        LANGUAGE
        LANG
        LC_*
Environment variables to remove:
        PERL5OPT
        PERL5LIB
        PERLLIB
        JAVA_TOOL_OPTIONS
        SHELLOPTS
        PS4
        BASH_ENV
        ENV
        TERMCAP
        TERMPATH
        TERMINFO_DIRS
        TERMINFO
        KRB5_CONFIG*
        SHLIB_PATH
        _RLD*
        LD_*
        PATH_LOCALE
        NLSPATH
        HOSTALIASES
        RES_OPTIONS
        LOCALDOMAIN
        CDPATH
        IFS
Local IP address and netmask pairs:

Now 'sudo -V' from my just installed 1.6.9p16:

# sudo -V
Sudo version 1.6.9p16

Sudoers path: /opt/iexpress/sudo/etc/sudoers
Authentication methods: 'pam'
Syslog facility if syslog is being used for logging: local2
Syslog priority to use when user authenticates successfully: notice
Syslog priority to use when user authenticates unsuccessfully: alert
Send mail if the user is not in sudoers
Lecture user the first time they run sudo
Require users to authenticate by default
Root may run sudo
Log the hostname in the (non-syslog) log file
Allow some information gathering to give useful error messages
Require fully-qualified hostnames in the sudoers file
Set the LOGNAME and USER environment variables
Length at which to wrap log file lines (0 for no wrap): 80
Authentication timestamp timeout: 5 minutes
Password prompt timeout: 5 minutes
Number of tries to enter a password: 3
Umask to use or 0777 to use user's: 022
Path to mail program: /usr/sbin/sendmail
Flags for mail program: -t
Address to send mail to: root
Subject line for mail messages: *** SECURITY information for %h ***
Incorrect password message: Sorry, try again.
Path to authentication timestamp dir: /var/run/sudo
Default password prompt: Password:
Default user to run commands as: root
Path to the editor for use by visudo: /usr/bin/vi
When to require a password for 'list' pseudocommand: any
When to require a password for 'verify' pseudocommand: all
File containing dummy exec functions: /opt/iexpress/sudo/libexec/sudo_noexec.so
Reset the environment to a default set of variables
Environment variables to check for sanity:
        TERM
        LINGUAS
        LC_*
        LANGUAGE
        LANG
        COLORTERM
Environment variables to remove:
        RUBYOPT
        RUBYLIB
        PYTHONINSPECT
        PYTHONPATH
        PYTHONHOME
        TMPPREFIX
        ZDOTDIR
        READNULLCMD
        NULLCMD
        FPATH
        PERL5DB
        PERL5OPT
        PERL5LIB
        PERLLIB
        PERLIO_DEBUG
        JAVA_TOOL_OPTIONS
        SHELLOPTS
        GLOBIGNORE
        PS4
        BASH_ENV
        ENV
        TERMCAP
        TERMPATH
        TERMINFO_DIRS
        TERMINFO
        SHLIB_PATH
        _RLD*
        LD_*
        PATH_LOCALE
        NLSPATH
        HOSTALIASES
        RES_OPTIONS
        LOCALDOMAIN
        CDPATH
        IFS
Environment variables to preserve:
        XAUTHORIZATION
        XAUTHORITY
        TZ
        PS2
        PS1
        PATH
        MAIL
        LS_COLORS
        KRB5CCNAME
        HOSTNAME
        HOME
        DISPLAY
        COLORS
Local IP address and netmask pairs:

This is due to PAM resetting the umask, not sudo (specifically the pam_hpsec module).  See the security(4) man page for more info.  If you are not able to configure PAM to preserve the umask, you can try running configure with the --disable-pam-session flag which will prevent sudo from running the PAM session code.

(In reply to comment #4)
> This is due to PAM resetting the umask, not sudo (specifically the
> pam_hpsec module).  See the security(4) man page for more info.  If you
> are not able to configure PAM to preserve the umask, you can try
> running configure with the --disable-pam-session flag which will
> prevent sudo from running the PAM session code.
> 

Indeed, one of the HP ITRC forum users suggested adding the following to pam.conf and it solved the problem:

"sudo   session required       libpam_hpsec.so.1 bypass_umask"

Thanks for the assistance