The default global umask setting must be changed for system processes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58419	AOSX-09-001020	SV-72849r1_rule		Medium

Description
The default global umask setting must be set to '022' for system processes. The setting '022' ensures that system process created files and directories will only be readable by other users and processes, not writable. This mitigates the risk that unauthorized users might be able to write to files and directories created by system processes. A more restrictive setting could potentially break the normal functionality of the system.

Description

The default global umask setting must be set to '022' for system processes. The setting '022' ensures that system process created files and directories will only be readable by other users and processes, not writable. This mitigates the risk that unauthorized users might be able to write to files and directories created by system processes. A more restrictive setting could potentially break the normal functionality of the system.

STIG	Date
Apple OS X 10.9 (Mavericks) Workstation Security Technical Implementation Guide	2015-02-26

Details

Check Text ( C-59245r1_chk )
To view the umask setting, run the following command: umask If the setting is not '022', this is a finding.

Fix Text (F-63733r2_fix)
To set the umask setting for applications, run the following command: sudo sh -c 'echo 'umask 022' > /etc/launchd.conf'