Ensure sudo umask is appropriate - sudo umask
Forces sudo to create files with a restrictive umask of 0027 so privileged commands do not leave group/world-readable files behind.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The umask controls the default permissions assigned to files created by a process. When commands are run through sudo, they execute with elevated privileges, so any file they create can end up with overly permissive modes if the umask is too loose. Setting Defaults umask=0027 (plus umask_override to force it regardless of the caller's shell) ensures privileged commands create files that are not readable or writable by group/other, reducing the chance that sensitive data written by a root command is exposed to unauthorized users.
What Pavois checks
Pavois checks the effective sudo policy by grepping /etc/sudoers and every drop-in under /etc/sudoers.d/ for an active Defaults ... umask line. Because sudo resolves its configuration from the main file plus all @includedir drop-ins, scanning the whole set (rather than a single file) reflects the policy sudo actually applies at runtime.
describe command('grep -rqE \'^[^#]*Defaults[^#]*\bumask\b\' /etc/sudoers /etc/sudoers.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run sudo grep -rE '^[^#]*Defaults[^#]*\bumask\b' /etc/sudoers /etc/sudoers.d/, it should return a line such as Defaults umask=0027. You can also confirm the file parses with sudo visudo -cf /etc/sudoers.d/99-Pavois-umask (expected: parsed OK).
Inspect & investigate
sudo activity is logged to /var/log/auth.log (Debian) or /var/log/secure (RHEL); inspect entries with journalctl _COMM=sudo. The umask setting itself produces no log line, but you can observe its effect on the permissions of files created by sudo-run commands.
Remediation
Pavois's harden plan writes a drop-in file /etc/sudoers.d/99-Pavois-umask (owner root:root, mode 0440) containing Defaults umask=0027 and Defaults umask_override, and validates it with visudo -cf before activating it. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | Defaults umask=0027 Defaults umask_override |
|---|---|
| group | root |
| mode | 0440 |
| owner | root |
| path | /etc/sudoers.d/99-pavois-umask |
| resource | file |
| verify | visudo -cf %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low operational impact: a 0027 umask only tightens permissions on newly created files; it does not change ownership or existing files. Some tooling that expects group-readable output from sudo-run commands could be affected, so review automation that relies on world/group-readable files. The drop-in is validated with visudo -cf before activation, never edit sudoers directly without visudo, since a syntax error can break sudo entirely and lock you out of privilege escalation.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R39 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.