Ensure root user umask is configured

보통레벨 1자동linux

설명

The user file-creation mode mask (umask) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (rwxrwxrwx), and for any newly created file it is 0666 (rw-rw- rw-). The umask modifies the default Linux permissions by restricting (masking) these permissions. The umask is not simply subtracted, but is processed bitwise. Bits set in the umask are cleared in the resulting file mode. umask can be set with either Octal or Symbolic values: • Octal (Numeric) Value - Represented by either three or four

점검 방법

감사 방식: 셸 명령

shell

alt0() { o=$(bash -c 'grep -Psi -- '"'"'^\h*umask\h+((\d{1,2}(\d[^7]|[^2- 7]\d)\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\b)(,o=[rwx]{1,3})?)|((g=[ wrx]{1,3},)?o=[wrx]{1,3}\b)))'"'"' /root/.bash_profile /root/.bashrc' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Edit /root/.bash_profile and /root/.bashrc and either: • remove, comment out, or update any line with umask. - OR - • update any line that includes umask to a value of 0027 or more restrictive. Example: umask 027 Note: the Recommendation "Ensure default user umask is configured" includes guidance to set the default umask

속성

운영 체제: alinux-3
태그: cis-convertedlinux
참고 자료: CIS Alibaba Cloud Linux 3 Benchmark v2.0.0 - 5.4.2.6

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux