Setting umask for su root

Question

In my user account I set the umask to be 022 with my .bashrc, but I want root to use a umask of 077 no matter how I become root (e.g., logging in directly as root on a tty or using sudo or su). If I login to a tty as root, I get 077, so it is fine. For sudo in /etc/sudoers I have set

Defaults umask = 0022
Defaults umask_override

and I get 077, so again fine. For su, in /root/.bashrc I can set

umask 022

and I get a umask of 077, but I am not convinced this is the correct way to do it.

How do you set the umask for su root

Potentially relevant is that my /etc/login.defs has

UMASK           077
USERGROUPS_ENAB yes

Answer 1

This answer is bash specific, other shells have similar features, but since your answer mentioned .bashrc I'm going to assume you're using Bash.

What you're encountering is that a shell can either be invoked as an interactive or a login shell.

• bash -l - login
• bash -i - interactive

If you look in the Bash man page in the "INVOCATION" section you'll notice the following 2 comments:

• login

  A login shell is one whose first character of argument zero is a -, or one started with the --login option.

• interactive

  An interactive shell is one started without non-option arguments and without the -c option whose standard input and error are both connected to terminals (as determined by isatty(3)), or one started with the -i option.
  PS1 is set and $- includes i if bash is interactive, allowing a shell script or a startup file to test this state.

Interactive & login shells read the config files in the following order. It does this one first:

1. /etc/profile

Followed by one of these (which ever it finds first) in this order:

1. ~/.bash_profile
2. ~/.bash_login
3. ~/.profile

Interactive shells (that are not a login shell) read an additional config file, ~/.bashrc. Notice that they never read the /etc/bashrc config file directly. They read it through the ~/.bashrc file because of this stanza:

# Source global definitions
if [ -f /etc/bashrc ]; then
    . /etc/bashrc
fi

So what about the umask

To get both types of shells to read the umask you need to include it in one of the files mentioned above that both types of shell invocations will read, so I'd put it in /root/.bash_profile.

Answer 2

You can set root's umask in /root/.profile and tell su to start the shell as a login shell.

su -