Groff / grops temp file location

Question

I was bit by the sudo grace period bug. Because sudo has a brief grace period,
during which anyone can execute it without being prompted for a password, anyone
who makes it past the firewall can execute anything he wants if he knows when sudo
was last executed. One clever chap changed my root password on me.
I share this verbose background because I want others to be aware of this security hole.
Add these three lines to /etc/sudoers, which removes grace period and prints su activity
in a secure file (so no one knows when su or sudo is executed).
Defaults:ALL timestamp_timeout=0
Defaults:ALL !syslog
Defaults:ALL logfile=/var/log/secure.log
Now on to the question. Because I followed this inconvenience with a reset of all
permissions, I suddenly found that grops (the troff2ps postprocessor underlying
groff) no longer had permission to create temp files, rendering it defunct. I can
only run it successfully as root(!).
Because I cannot find the src for grops, I do not know where the temp files are
created. The man page's specification of /tmp/gropsXXXXX is incorrect. I need
to find that directory and liberalize the permissions.
Thank you.

Answer 1

Thank you for your interest in my other security issues. I was able to resecure root and the machine right away...
Great! Sorry I wasted your time with my post then. I must confess that I know pretty much nothing about groff/grops. But I didn't realize that you had simplified your post and weren't having further root problems.
That said, I hope the following isn't equally useless:
1. According to the groff man page:
<pre style="line-height: 50%; background: #eee">
GROFF_TMPDIR
The directory in which temporary files will be created. If this
is not set but the environment variable TMPDIR instead, tempo-
rary files will be created in the directory $TMPDIR. On MS-DOS
and Windows 32 platforms, the environment variables TMP and TEMP
(in that order) are searched also, after GROFF_TMPDIR and
TMPDIR. Otherwise, temporary files will be created in /tmp.
The refer(1), groffer(1), grohtml(1), and grops(1) commands use
temporary files.
</pre>
To my surprise, $TMPDIR is set to something seemingly obscure: /var/folders/XX/XXYYYYYYYYYYYYY/-Tmp-/ where XX is a random pair of characters and YYYYYYYYYYYYY is another random sequence of characters. This folder is owned by the currently logged-in user, and has permissions 0700! YMMV, but this, and the parent directories, may be worth investigating.
2. You may already know this, but just in case (or for anyone else who reads this), 0777 is the wrong permissions for tmp-like directories. The correct permissions is 01777, or drwxrwxrwt. The difference (the '1' in the 512-place) is the "sticky bit" and partially overrides the write-permissions to prevent users from deleting files that they don't own. This is a useful security measure: otherwise, say, an attacker could potentially attempt to exploit a race condition, and replace the temporary file which grops creates with a different file, before grops gets around to reading the temporary file which it created. (On the other hand, with the sticky bit set, a different security issue is created, namely, if the 'XXXXXX' part of the gropsXXXXXX filename is predictable--e.g. the PID of the grops process--then an attacker could try to create the gropsXXXXXX before grops gets a chance to, thereby effecting a DOS attack.) I would be surprised if the incorrect permissions would be an issue for you--why would groff/grops check the sticky bit on the temporary directory?--but it is still worth fixing, if necessary.