Ensure root user umask is configured

MediumLevel 1Automatedlinux

Description

The user file-creation mode mask (umask) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (rwxrwxrwx), and for any newly created file it is 0666 (rw-rw- rw-). The umask modifies the default Linux permissions by restricting (masking) these permissions. The umask is not simply subtracted, but is processed bitwise. Bits set in the umask are cleared in the resulting file mode. umask can be set with either Octal or Symbolic values: • Octal (Numeric) Value - Represented by either three or four

How it is checked

Audit method: Shell command

shell

alt0() { o=$(bash -c 'grep -Psi -- '"'"'^\h*umask\h+((\d{1,2}(\d[^7]|[^2- 7]\d)\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\b)(,o=[rwx]{1,3})?)|((g=[ wrx]{1,3},)?o=[wrx]{1,3}\b)))'"'"' /root/.bash_profile /root/.bashrc' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit /root/.bash_profile and /root/.bashrc and either: • remove, comment out, or update any line with umask. - OR - • update any line that includes umask to a value of 0027 or more restrictive. Example: umask 027 Note: the Recommendation "Ensure default user umask is configured" includes guidance to set the default umask

Properties

Operating systems: rocky-8
Tags: cis-convertedlinux
Reference: CIS Rocky Linux 8 Benchmark v3.0.0 - 5.4.2.6

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux