Detections
Analytics

5.4.3.4 Ensure default user umask is configured

Information

The user file-creation mode mask ( umask ) determines the permissions withheld from newly created files and directories. A user's effective umask is the value in force after login; the shell-initialization files /etc/profile, files under /etc/profile.d/, and /etc/bashrc can set it and can override the system baseline. This recommendation covers those shell-initialization sources; the baseline value in /etc/login.defs is covered by the separate recommendation Ensure default user umask is configured in /etc/login.defs.

A umask less restrictive than 0027 causes new files and directories to be readable or writable by users other than the owner. A shell-initialization file that sets a permissive umask overrides a restrictive baseline for every interactive login, extending those group- or other-accessible defaults to every file created in that session.

Solution

Identify any shell-initialization umask statement less restrictive than 0027, and tighten or remove it. When no shell-init source sets a umask, the /etc/login.defs baseline (a separate recommendation) governs the default.

 - Locate the umask statements in the shell-initialization files:

# grep -PHrsi -- '^\h*umask\b' /etc/profile /etc/profile.d/ /etc/bashrc /etc/bash.bashrc

 - For each statement returned that is less restrictive than 0027, edit the file to set a compliant value:

umask 027

or remove the statement so the /etc/login.defs baseline governs the default.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-6b., 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: d684349b6dce5517f9512436f281f4c3afaa71eeab06cc2b8d93f4b54e57c486