documentation_complete: true

prodtype: rhel7

title: 'Ensure All User Initialization Files Have Mode 0740 Or Less Permissive'

description: |-
    Set the mode of the user initialization files to <tt>0740</tt> with the
    following command:
    <pre>$ sudo chmod 0740 /home/<i>USER</i>/.<i>INIT_FILE</i></pre>

rationale: |-
    Local initialization files are used to configure the user's shell environment
    upon logon. Malicious modification of these files could compromise accounts upon
    logon.

severity: medium

identifiers:
    cce: 80525-9

references:
    disa: 366
    nist: ""
    srg: SRG-OS-000480-GPOS-00227
    stigid: "020710"

ocil_clause: 'they are not 0740 or more permissive'

ocil: |-
    To verify that all user initialization files have a mode of <tt>0740</tt> or
    less permissive, run the following command:
    <pre>$ sudo find /home -type f -name '\.*' \( -perm -0002 -o -perm -0020 \)</pre>
    There should be no output.
