1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
documentation_complete: true
title: 'Ensure sudo umask is appropriate - sudo umask'
description: |-
The sudo <tt>umask</tt> tag, when specified, will be added the to the user's umask in the
command environment.
{{%- if 'rhel' in product or 'ol' in families %}}
On {{{ full_name }}}, the default <tt>umask</tt> value is 0022.
{{% endif %}}
The umask should be configured by making sure that the <tt>umask={{{ xccdf_value("var_sudo_umask") }}}</tt> tag exists in
<tt>/etc/sudoers</tt> configuration file or any sudo configuration snippets
in <tt>/etc/sudoers.d/</tt>.
rationale: |-
The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.
severity: medium
identifiers:
cce@rhel8: CCE-83860-7
cce@sle12: CCE-91498-6
cce@sle15: CCE-91189-1
ocil_clause: 'umask is not set with the appropriate value for sudo'
ocil: |-
To determine if <tt>umask</tt> has been configured for sudo with the appropriate value,
run the following command:
<pre>$ sudo grep -ri '^Defaults.*umask={{{ xccdf_value("var_sudo_umask") }}}' /etc/sudoers /etc/sudoers.d/</pre>
The command should return a matching output.
template:
name: sudo_defaults_option
vars:
option: umask
variable_name: "var_sudo_umask"
|
