mediumaccess-controlverified ✓rollback-safe

Ensure c shell defines restrictive default permissions

shell-csh-umask · RHEL ≥ 8 · 1 impl

Description

The C shell (csh/tcsh) default umask must be configured to restrict permissions on newly created files and directories.

Rationale

A restrictive C shell umask of 077 ensures files created during a csh session are not readable by other users, protecting user data.

Check → Remediate

Checkcommand

# Check /etc/csh.cshrc and /etc/csh.login for umask
if grep -qE '^\s*umask\s+0?0?77' /etc/csh.cshrc 2>/dev/null; then
  exit 0
fi
if grep -qE '^\s*umask\s+0?0?77' /etc/csh.login 2>/dev/null; then
  exit 0
fi
exit 1

expected_exit:: 0

Remediateconfig_set

path:: /etc/csh.cshrc
key:: umask
value:: 077

Framework references

STIG

V-281081 / RHEL-10-400320V-258073 / RHEL-09-412060

NIST 800-53

AC-6(1)CM-6

Live verification

rhel9:check

#shell#csh#umask#permissions