Ensure the file permissions mask is correct

보통레벨 1수동 검토yugabytedb

설명

Files are always created using a default set of permissions. File permissions can be restricted by applying a permissions mask called the umask. The yugabyte user account should use a umask of 077 to deny file access to all user accounts except the owner.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

As root run su - yugabyte -c umask. The umask of the yugabyte user must be 0077 or more restrictive; anything less restrictive (e.g. the default 0022) is a finding. Check .bash_profile, .profile and .bashrc of the yugabyte user.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Depending upon the yugabyte user's environment, the umask is typically set in the initialization file .bash_profile, but may also be set in .profile or .bashrc. To set the umask, add the following to the appropriate profile file: # whoami yugabyte # cd ~ # ls -ld .{bash_profile,profile,bashrc} ls: cannot access '.bash_profile': No such file or directory ls: cannot access '.profile': No such file or directory ls: cannot access '.bashrc': No such ...

속성

운영 체제: 모두
태그: yugabytedbpermissions
참고 자료: CIS YugabyteDB Benchmark v2.0.0 - 2.1 Ensure the file permissions mask is correct