Skip to content
ATO Pathways
  Log In

Ensure the Default Umask is Set Correctly in /etc/profile

An XCCDF Rule

Description

To ensure the default umask controlled by /etc/profile is set properly, add or correct the umask setting in /etc/profile to read as follows: 

umask
Note that /etc/profile also reads scrips within /etc/profile.d directory. These scripts are also valid files to set umask value. Therefore, they should also be considered during the check and properly remediated, if necessary.

Rationale

The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

ID
xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile
Severity
Medium
References
Updated



Remediation - script:ignition

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0