This is a regression due to commit commit 8d25777:

8d2577786cce6fcc915836108e405dbf5025dec8
Author: Bryn M. Reeves <bmr>
Date:   Tue Apr 29 19:02:43 2014 +0100

    Drop cwd/umask shenanigans from TarFileArchive::finalize()
    

Although the cwd manipulations are no longer needed the umask modification is - I run my systems with a umask of 077 for root (which gives the expected behaviour even after the above commit). However as the default root umask for Red Hat distros has always been 022 we fail to drop group and other read privileges for the archive in the default install case.

Reverting the two umask lines from the above patch obviously fixes the problem but don't think this is the best approach for 7.1; one of the motivations for removing this code is that the archive classes in sos explicitly do not handle exceptions (it's handled in the main sosreport class that calls the archive methods).

Fiddling with the umask in the archive complicates this because it's unclear when an exception occurs within Archive.finalize() whether or not the umask needs to be reset or not.

I think it's better to deal with  this by moving the umask manipulation up to SoSReport; that way the umask cleanup happens under a 'finally' block and doesn't need any special treatment to avoid leaking changes to the mask on error.

--- /root/src/git/sos/sos/sosreport.py  2014-09-19 15:33:07.872321514 +0100
+++ /usr/lib/python2.7/site-packages/sos/sosreport.py   2014-10-30 17:03:44.216321514 +0000
@@ -1327,6 +1327,7 @@ class SoSReport(object):
         self._finish_logging()
         # package up the results for the support organization
         if not self.opts.build:
+            old_umask = os.umask(0o077)
             if not self.opts.quiet:
                 print(_("Creating compressed archive..."))
             # compression could fail for a number of reasons
@@ -1345,6 +1346,8 @@ class SoSReport(object):
                     raise
                 else:
                     return False
+            finally:
+                os.umask(old_umask)
         else:
             final_filename = self.archive.get_archive_path()
         self.policy.display_results(final_filename, build=self.opts.build)

Fixed upstream:

commit d7759d3ddae5fe99a340c88a1d370d65cfa73fd6
Author: Bryn M. Reeves <bmr>
Date:   Thu Oct 30 16:46:01 2014 +0000

    [sosreport] fix archive permissions regression
    
    Restore the umask save/restore around archive creation and ensure
    the effective umask is 077 at the time of archive creation.
    
    Fixes #425.
    
    Signed-off-by: Bryn M. Reeves <bmr>

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0532.html