UCF STIG Viewer Logo

The default global umask setting must be changed for system processes.


Overview

Finding ID Version Rule ID IA Controls Severity
V-58419 AOSX-09-001020 SV-72849r1_rule Medium
Description
The default global umask setting must be set to '022' for system processes. The setting '022' ensures that system process created files and directories will only be readable by other users and processes, not writable. This mitigates the risk that unauthorized users might be able to write to files and directories created by system processes. A more restrictive setting could potentially break the normal functionality of the system.
STIG Date
Apple OS X 10.9 (Mavericks) Workstation Security Technical Implementation Guide 2017-01-05

Details

Check Text ( C-59245r1_chk )
To view the umask setting, run the following command:

umask

If the setting is not '022', this is a finding.
Fix Text (F-63733r2_fix)
To set the umask setting for applications, run the following command:

sudo sh -c 'echo 'umask 022' > /etc/launchd.conf'