mediumaccess-controlverified ✓rollback-safe

Ensure bash shell defines restrictive default permissions

shell-bash-umask · RHEL ≥ 8 · 1 impl

Description

The bash shell default umask must be configured to restrict permissions on newly created files and directories.

Rationale

A restrictive bash umask of 077 ensures that files and directories created during a bash session are not readable or writable by other users by default, protecting user data from unauthorized access.

Check → Remediate

Checkcommand

# Check /etc/bashrc and /etc/profile.d/*.sh for umask
if grep -qE '^\s*umask\s+0?0?77' /etc/bashrc 2>/dev/null; then
  exit 0
fi
if grep -rqE '^\s*umask\s+0?0?77' /etc/profile.d/ 2>/dev/null; then
  exit 0
fi
exit 1

expected_exit:: 0

Remediateconfig_set

path:: /etc/bashrc
key:: umask
value:: 077

Framework references

STIG

V-281080 / RHEL-10-400315V-258072 / RHEL-09-412055

NIST 800-53

AC-6(1)CM-6

Live verification

rhel9:check

#shell#bash#umask#permissions