Detections
Analytics

3.1 Ensure default user umask is configured

Information

The user file-creation mode mask ( umask ) is used to determine the file permission for newly
created directories and files. In AIX, the default permissions for any newly created
directory is 0755 (rwxr-xr-x), and for any newly created file it is 0644 (rw-r--r--). The
umask modifies the default AIX permissions by restricting (masking) these permissions.
The umask is not simply subtracted, but is processed bitwise. Bits set in the umask are
cleared in the resulting file mode.

Setting a very secure default value for umask ensures that users make a conscious choice
about their file permissions. A permissive umask value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users.

Solution

Add the umask attribute to the default user stanza in /etc/security/user :

chsec -f /etc/security/user -s default -a umask=027

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: fbc01eb330ecc502bd8103dc1ceb7b5b5c0c76e9908eeaeb9b2a5b2b25adbb0d