Detections
Analytics

5.4.2.6 Ensure root user umask is configured

Information

The user file-creation mode mask ( umask ) determines the permissions applied to newly created files and directories. On Linux the default permissions are 0777 (rwxrwxrwx) for a new directory and 0666 (rw-rw-rw-) for a new file; the umask restricts (masks) these defaults bitwise - bits set in the umask are cleared in the resulting mode.

A umask can be expressed as an octal or a symbolic value:

 - Octal (numeric) value - three or four digits, for example umask 0027 or umask 027 . When four digits are given the leading digit is ignored; the remaining three set the masking for user, group, and other respectively.
 - Symbolic value - a comma-separated list of the permissions to keep for user ( u ), group ( g ), and other ( o ). For example, umask u=rwx,g=rx,o= is equivalent to the octal umask 027, producing a new directory of drwxr-x--- and a new file of rw-r-----.

root's effective umask is the value in force after every source that sets it (the system defaults and root's own shell initialization files) has been applied in order of precedence.

A permissive umask value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users.

Solution

Edit /root/.bash_profile and /root/.bashrc and set root's umask to 0027 or more restrictive by adding or modifying the umask line to read:

umask 027

After making the change, verify that root's effective login umask resolves to 0027 or more restrictive, since a umask set in a system-wide location (for example /etc/profile or a file under /etc/profile.d/) can override the value set in root's shell initialization files.

Note: The recommendation "Ensure default user umask is configured" includes guidance to set the default umask.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 4356dfa13a61fe795860c4aea517e3135c3b2a272b0662f774455b4076cba4f9