TMA-ROCKY8-5.4.2.6

Ensure root user umask is configured

MittelStufe 1Automatisiertlinux

Beschreibung

The user file-creation mode mask (umask) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (rwxrwxrwx), and for any newly created file it is 0666 (rw-rw- rw-). The umask modifies the default Linux permissions by restricting (masking) these permissions. The umask is not simply subtracted, but is processed bitwise. Bits set in the umask are cleared in the resulting file mode. umask can be set with either Octal or Symbolic values: • Octal (Numeric) Value - Represented by either three or four

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { o=$(bash -c 'grep -Psi -- '"'"'^\h*umask\h+((\d{1,2}(\d[^7]|[^2- 7]\d)\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\b)(,o=[rwx]{1,3})?)|((g=[ wrx]{1,3},)?o=[wrx]{1,3}\b)))'"'"' /root/.bash_profile /root/.bashrc' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Edit /root/.bash_profile and /root/.bashrc and either: • remove, comment out, or update any line with umask. - OR - • update any line that includes umask to a value of 0027 or more restrictive. Example: umask 027 Note: the Recommendation "Ensure default user umask is configured" includes guidance to set the default umask

Eigenschaften

Betriebssysteme: rocky-8
Tags: cis-convertedlinux
Referenz: CIS Rocky Linux 8 Benchmark v3.0.0 - 5.4.2.6

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target linux