mediumaccess-controlverified ✓rollback-safe

Ensure system default profile defines restrictive default permissions

shell-profile-umask · RHEL ≥ 8 · 1 impl

Description

The system default shell profile (/etc/profile) must define a restrictive umask to limit permissions on newly created files.

Rationale

The /etc/profile script runs for all interactive login shells and sets the default environment. A restrictive umask of 077 in this file ensures that all users have a restrictive default regardless of their specific shell configuration.

Check → Remediate

Checkcommand

if grep -qE '^\s*umask\s+0?0?77' /etc/profile 2>/dev/null; then
  exit 0
fi
if grep -rqE '^\s*umask\s+0?0?77' /etc/profile.d/ 2>/dev/null; then
  exit 0
fi
exit 1

expected_exit:: 0

Remediateconfig_set_dropin

dir:: /etc/profile.d
file:: 00-kensa-umask.sh
key:: umask
value:: 077

Framework references

STIG

V-281083 / RHEL-10-400330V-258075 / RHEL-09-412070

NIST 800-53

AC-6(1)CM-6

Live verification

rhel9:check

#shell#profile#umask#permissions