Ensure local interactive user init files set umask 077 or more restrictive

fail=0
files=$(find /home -maxdepth 2 -type f -name '.[^.]*' ! -name '.bash_history' 2>/dev/null)
for hf in $files; do
  val=$(grep -iE '^[[:space:]]*umask[[:space:]]+' "$hf" 2>/dev/null | awk '{print $2}' | tail -1)
  [ -n "$val" ] || continue
  case "$val" in
    *[!0-7]*) echo "FAIL: $hf sets non-numeric umask '$val' (review)"; fail=1; continue ;;
  esac
  # The group+other digits are the last two octal positions; both must be
  # 7 (fully masked) to be 077-or-more-restrictive. Portable string test —
  # no base-N arithmetic (dash lacks $((8#..))).
  last2=$(printf '%s' "$val" | sed 's/.*\(..\)$/\1/')
  if [ "$last2" != "77" ]; then
    echo "FAIL: $hf sets umask $val (less restrictive than 077)"
    fail=1
  fi
done
if [ "$fail" -eq 0 ]; then
  echo "OK: no user init file sets a umask less restrictive than 077"
  exit 0
fi
exit 1

expected_exit:

0

note:

Remove the umask line from the offending user initialization file so the system-wide 077 default applies, or set it to 077 explicitly: umask 077