sudo umask 077

[Mario Brand]

We have a 11.23 IA64 system and installed sudo. Sudo has the option to supply the umask sudo should use in the sudoers file. We specified umask=022. But it is ignored.
the command sudo umask always returns 077. We tried everything: newer versions of sudo (both from the HP IE CD as from the Porting Archive) and even recompiling sudo with the flag --with-umask=0022. NOthing helps. I even hacked the code at various places to get the right umask. We keep getting umask 077.
So what is going on? Any help is appreciated.

Thanks,
Mario Brand

[Marco A.]

Hello,


What are you trying to run with su ?, what you are seeing with the umask command is your environment mask that is set in the .profile file, if you want those changes to be reflected you need to change them in the profile file of the user/s that you want to su.

Try it and let us know!

Regards,


Marco

[ABrown_1]

I have had a problem with the current 1.6.9p16 on HPUX 11.23. The same version on 11.11 works when you have Defaults: !umask set. On 11.23 it will not work with the same sudoers and the same version. Someone needs to report a bug to the maker. Unless someone here has a fix??
On 11.11 in sudoers : Defaults !umask
umask 022
sudo umask
(returns 022)

On 11.23 it always returns 077 as the umask with the same version.

[Philippe Delmee]

I have the same problem on HPUX 11.31 with version 1.6.9p16.
We keep getting umask 077 (sudo -u toto umask always return 077) and this is a critical issue!

Thanks
JC

[Val Naipaul]

We have the same problem, with 1.6.9p16 on PA 11.23, IA 11.23 and IA 11.31. This is the Internet Express suite build.

I've reopened bug 291 about this (which was originally opened for !umask not seeming to work, but I too am having no luck getting any sudoers umask setting to take effect): http://www.gratisoft.us/bugzilla/show_bug.cgi?id=291

Val

[Speedware]

By the way I have problem as stated above. Here is the solution the sudo bug web site.

"This is due to PAM resetting the umask, not sudo (specifically the
pam_hpsec module). See the security(4) man page for more info. If you
are not able to configure PAM to preserve the umask, you can try
running configure with the --disable-pam-session flag which will
prevent sudo from running the PAM session code."

I want to know how do you the modify the PAM to preserve the umask ?

[Medavie]

The secret is in the pam.conf
pam_hpsec is overriding the umask. To make it work you need to modify the pam.conf file under the session section.
run command
sudo umask
0777

Modify line
#OTHER session required libpam_hpsec.so.1
to
OTHER session required libpam_hpsec.so.1 bypass_umask

then run command
sudo umask
02

Now for the fun part.... what exactly does this change mean.. I do not know. I'd suggest running in test for a while until your comfortable before implementing in prod.

Thanks

Ralph

[Medavie]

Actually after further testing its best if you add to the sessions section of your pam.conf file
sudo session required libpam_hpsec.so.1 bypass_umask

That makes it specific for sudo and does not / nor will it screw up anything else that the OTHER field uses.

Hope this helps you

Ralph

[Val Naipaul]

Adding "sudo session required libpam_hpsec.so.1 bypass_umask" to pam.conf worked - now I'm seeing the umask settings in sudoers taking effect.

Thanks very much Ralph!

Val