documentation_complete: true

prodtype: rhel7

title: 'Ensure the Default Umask is Set Correctly For Interactive Users'

description: 'Remove the <tt>UMASK</tt> environment variable from all interactive users initialization files.'

rationale: |-
    The umask controls the default access mode assigned to newly created files. A
    umask of 077 limits new files to mode 700 or less permissive. Although umask can
    be represented as a four-digit number, the first digit representing special
    access modes is typically ignored or required to be 0. This requirement
    applies to the globally configured system defaults and the local interactive
    user defaults for each account on the system.

severity: medium

identifiers:
    cce: 80536-6

references:
    disa: 1814
    nist: ""
    srg: SRG-OS-000480-GPOS-00227
    stigid: "021040"

ocil_clause: 'the above command returns no output, or if the umask is configured incorrectly'

ocil: |-
    Verify the <tt>UMASK</tt> setting is not configured for interactive users,
    run the following command:
    <pre>$ sudo grep -ri "UMASK" /home</pre>
    There should be no output.
