UCF STIG Viewer Logo

The default umask for system and users must be 077.


Overview

Finding ID Version Rule ID IA Controls Severity
V-216341 SOL-11.1-040250 SV-216341r603267_rule Medium
Description
Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions.
STIG Date
Solaris 11 SPARC Security Technical Implementation Guide 2022-11-18

Details

Check Text ( C-17577r371111_chk )
The root role is required.

Determine if the default umask is configured properly.

# grep -i "^UMASK=" /etc/default/login

If "UMASK=077" is not displayed, this is a finding.

Check local initialization files:
# cut -d: -f1 /etc/passwd | xargs -n1 -iUSER sh -c "grep umask ~USER/.*"

If this command does not output a line indicating "umask 077" for each user, this is a finding.
Fix Text (F-17575r371112_fix)
The root role is required.

Edit local and global initialization files containing "umask" and change them to use 077.

# pfedit /etc/default/login

Insert the line
UMASK=077

# pfedit [user initialization file]

Insert the line
umask 077