Skip to content

5.4.3.3 Ensure default user umask is configured

Audit#

Run the following to verify the default user umask is set to 027(octal) or u=rwx,g=rx,o= (Symbolic) to enforce newly created directories' permissions to be 750 (drwxr-x---), and newly created file's permissions be 640 (rw-r-----), or more restrictive: 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
#!/usr/bin/env bash
{
l_output="" l_output2=""
file_umask_chk()
{
if grep -Psiq -- '^\h*umask\h+(0?[0-7][2-7]7|u(=[rwx]{0,3}),g=([rx]{0,2}),o=)(\h*#.*)?$' "$l_file"; then
l_output="$l_output\n - umask is set correctly in \"$l_file\""
elif grep -Psiq -- '^\h*umask\h+(([0-7][0-7][01][0-7]\b|[0-7][0-7][0-7][0-6]\b)|([0-7][01][0-7]\b|[0-7][0-7][0-6]\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\b)(,o=[rwx]{1,3})?)|((g=[wrx]{1,3},)?o=[wrx]{1,3}\b)))' "$l_file"; then
l_output2="$l_output2\n - umask is incorrectly set in \"$l_file\""
fi
}
while IFS= read -r -d $'\0' l_file; do
file_umask_chk
done < <(find /etc/profile.d/ -type f -name '*.sh' -print0)
[ -z "$l_output" ] && l_file="/etc/profile" && file_umask_chk
[ -z "$l_output" ] && l_file="/etc/bashrc" && file_umask_chk
[ -z "$l_output" ] && l_file="/etc/bash.bashrc" && file_umask_chk
[ -z "$l_output" ] && l_file="/etc/pam.d/postlogin"
if [ -z "$l_output" ]; then
if grep -Psiq --
'^\h*session\h+[^#\n\r]+\h+pam_umask\.so\h+([^#\n\r]+\h+)?umask=(0?[0-7][2-7]7)\b' "$l_file"; then
l_output1="$l_output1\n - umask is set correctly in \"$l_file\""
elif grep -Psiq
'^\h*session\h+[^#\n\r]+\h+pam_umask\.so\h+([^#\n\r]+\h+)?umask=(([0-7][0-7][01][0-7]\b|[0-7][0-7][0-7][0-6]\b)|([0-7][01][0-7]\b))' "$l_file"; then
l_output2="$l_output2\n - umask is incorrectly set in \"$l_file\""
fi
fi
[ -z "$l_output" ] && l_file="/etc/login.defs" && file_umask_chk
[ -z "$l_output" ] && l_file="/etc/default/login" && file_umask_chk
[[ -z "$l_output" && -z "$l_output2" ]] && l_output2="$l_output2\n - umask is not set"
if [ -z "$l_output2" ]; then
echo -e "\n- Audit Result:\n ** PASS **\n - * Correctly configured * :\n$l_output\n"
else
echo -e "\n- Audit Result:\n ** FAIL **\n - * Reasons for audit failure * :\n$l_output2"
[ -n "$l_output" ] && echo -e "\n- * Correctly configured * :\n$l_output\n"
fi
}

Remediation#

Run the following script and perform the instructions in the output to set the default umask to 027 or more restrictive: 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/usr/bin/env bash
{
l_output="" l_output2="" l_out=""
file_umask_chk()
{
if grep -Psiq -- '^\h*umask\h+(0?[0-7][2-
7]7|u(=[rwx]{0,3}),g=([rx]{0,2}),o=)(\h*#.*)?$' "$l_file"; then
l_out="$l_out\n - umask is set correctly in \"$l_file\""
elif grep -Psiq -- '^\h*umask\h+(([0-7][0-7][01][0-7]\b|[0-7][0-7][0-
7][0-6]\b)|([0-7][01][0-7]\b|[0-7][0-7][0-
6]\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\b)(,o=[rwx]{1,3})?)|((g=[wrx
]{1,3},)?o=[wrx]{1,3}\b)))' "$l_file"; then
l_output2="$l_output2\n
- \"$l_file\""
fi
}
while IFS= read -r -d $'\0' l_file; do
file_umask_chk
done < <(find /etc/profile.d/ -type f -name '*.sh' -print0)
[ -n "$l_out" ] && l_output="$l_out"
l_file="/etc/profile" && file_umask_chk
l_file="/etc/bashrc" && file_umask_chk
l_file="/etc/bash.bashrc" && file_umask_chk
l_file="/etc/pam.d/postlogin"
if grep -Psiq
'^\h*session\h+[^#\n\r]+\h+pam_umask\.so\h+([^#\n\r]+\h+)?umask=(([0-7][0-
7][01][0-7]\b|[0-7][0-7][0-7][0-6]\b)|([0-7][01][0-7]\b))' "$l_file"; then
l_output2="$l_output2\n
- \"$l_file\""
fi
l_file="/etc/login.defs" && file_umask_chk
l_file="/etc/default/login" && file_umask_chk
if [ -z "$l_output2" ]; then
echo -e " - No files contain a UMASK that is not restrictive enough\n
No UMASK updates required to existing files"
else
echo -e "\n - UMASK is not restrictive enough in the following
file(s):$l_output2\n\n- Remediation Procedure:\n - Update these files and
comment out the UMASK line\n
or update umask to be \"0027\" or more
restrictive"
fi
if [ -n "$l_output" ]; then
echo -e "$l_output"
else
echo -e " - Configure UMASK in a file in the \"/etc/profile.d/\"
directory ending in \".sh\"\n\n
Example Command (Hash to represent being
run at a root prompt):\n\n# printf '%s\\\n' \"umask 027\" >
/etc/profile.d/50-systemwide_umask.sh\n"
fi
}

Notes: - This method only applies to bash and shell. If other shells are supported on the system, it is recommended that their configuration files also are checked - If the pam_umask.so module is going to be used to set umask, ensure that it's not being overridden by another setting. Refer to the PAM_UMASK(8) man page for more information

Default Value: UMASK 022