TMA-ROCKY8-5.4.2.6

Ensure root user umask is configured

СредњаНиво 1Аутоматскаlinux

Опис

The user file-creation mode mask (umask) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (rwxrwxrwx), and for any newly created file it is 0666 (rw-rw- rw-). The umask modifies the default Linux permissions by restricting (masking) these permissions. The umask is not simply subtracted, but is processed bitwise. Bits set in the umask are cleared in the resulting file mode. umask can be set with either Octal or Symbolic values: • Octal (Numeric) Value - Represented by either three or four

Како се проверава

Метод провере: Команда љуске

shell

alt0() { o=$(bash -c 'grep -Psi -- '"'"'^\h*umask\h+((\d{1,2}(\d[^7]|[^2- 7]\d)\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\b)(,o=[rwx]{1,3})?)|((g=[ wrx]{1,3},)?o=[wrx]{1,3}\b)))'"'"' /root/.bash_profile /root/.bashrc' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Edit /root/.bash_profile and /root/.bashrc and either: • remove, comment out, or update any line with umask. - OR - • update any line that includes umask to a value of 0027 or more restrictive. Example: umask 027 Note: the Recommendation "Ensure default user umask is configured" includes guidance to set the default umask

Својства

Оперативни системи: rocky-8
Ознаке: cis-convertedlinux
Референца: CIS Rocky Linux 8 Benchmark v3.0.0 - 5.4.2.6

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux