In my user account I set the umask to be 022 with my .bashrc, but I want root to use a umask of 077 no matter how I become root (e.g., logging in directly as root on a tty or using sudo or su). If I login to a tty as root, I get 077, so it is fine. For sudo in /etc/sudoers I have setDefaults umask = 0022Defaults umask_overrideand I get 077, so again fine. For su, in /root/.bashrc I can setumask 022and I get a umask of 077, but I am not convinced this is the correct way to do it. How do you set the umask for su rootPotentially relevant is that my /etc/login.defs hasUMASK           077USERGROUPS_ENAB yes
Setting umask for su root
su;umask
This answer is bash specific, other shells have similar features, but since your answer mentioned .bashrc I'm going to assume you're using Bash.What you're encountering is that a shell can either be invoked as an interactive or a login shell.bash -l - loginbash -i - interactiveIf you look in the Bash man page in the INVOCATION section you'll notice the following 2 comments:loginA login shell is one whose first character of argument zero is a -, or one started with the --login option.interactiveAn interactive shell is one started without non-option arguments and  without the -c option whose standard input and error  are  both  connected to  terminals (as determined by isatty(3)), or one started with the -i option.  PS1 is set and $- includes i if bash is interactive, allowing a shell script   or a startup file to test this state.Interactive & login shells read the config files in the following order. It does this one first:/etc/profileFollowed by one of these (which ever it finds first) in this order:~/.bash_profile~/.bash_login~/.profileInteractive shells (that are not a login shell) read an additional config file, ~/.bashrc. Notice that they never read the /etc/bashrc config file directly. They read it through the ~/.bashrc file because of this stanza:# Source global definitionsif [ -f /etc/bashrc ]; then    . /etc/bashrcfiSo what about the umaskTo get both types of shells to read the umask you need to include it in one of the files mentioned above that both types of shell invocations will read, so I'd put it in /root/.bash_profile.