Ensure the Default Bash Umask is Set Correctly
Ensures the system-wide Bash startup file /etc/bash.bashrc sets a restrictive umask (at least as strict as 0027/0077 per norm).
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The umask determines the permissions stripped from newly created files and directories. The system-wide Bash umask in /etc/bash.bashrc applies to interactive Bash shells; if it is too permissive, every file a user creates is world- or group-readable/writable by default, exposing data and config to unauthorized accounts. A restrictive umask (0027 for CIS, 0077 for ANSSI BP-028 R36) enforces least privilege on file creation across all users.
What Pavois checks
Pavois reads the last effective umask line in /etc/bash.bashrc and verifies it is at least as strict as the norm target with a bitmask test ((value & mask) == mask), so 0077 satisfies a 0027 requirement. Because shell rc files allow repeated assignments and the last one wins, Pavois takes the final matching line (tail -1) rather than the first - this mirrors what an interactive Bash shell actually applies, which a naive first-match grep would get wrong.
m = {'bp28'=>'0077','cis'=>'0027'}.fetch(input('pavois_standard', value: '_default'), '0077')
describe command("v=$(grep -hiE '^[[:space:]]*umask[[:space:]]+[0-7]+' /etc/bash.bashrc 2>/dev/null | grep -oE '[0-7]+' | tail -1); { [ -n \"$v\" ] && [ $((0$v & #{m})) -eq $((#{m})) ] && echo ok; } || echo ko") do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Inspect the configured value:
grep -hiE '^[[:space:]]*umask[[:space:]]+[0-7]+' /etc/bash.bashrc | tail -1
Expected a line like umask 027 (or stricter, e.g. umask 077). Confirm the runtime value in a fresh interactive shell with bash -i -c umask (expected 0027 or 0077).
Inspect & investigate
umask has no audit event; verify it from current state. Show the source line with grep -i umask /etc/bash.bashrc, and the value a login would inherit with bash -i -c umask. To see what a newly created file would get, umask in your shell then touch /tmp/t && stat -c '%a' /tmp/t.
Remediation
No automated harden plan is wired for this rule (remediation is empty), so it must be applied manually: add or correct a single line umask 027 (or umask 077 for ANSSI) in /etc/bash.bashrc, placed so it is not overridden by a later, looser umask line. New shells pick it up immediately; current sessions must re-source the file or re-login.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/bash.bashrc |
|---|---|
| line | umask 077 |
| module | umask 077 |
| resource | pam_line |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Tightening the default umask is generally safe but changes file-creation behavior for every interactive Bash user. Pitfalls: applications or deploy scripts that rely on group-shared files (e.g. a www-data/developers group expecting 0664) may break if they inherit 0077, which strips group access. Before enforcing, audit shared-directory workflows; where group collaboration is required, use setgid directories plus ACLs rather than loosening the global umask. The change only affects new files, never existing permissions, and is trivially reversible by editing the line back.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R36 | direct | 2.0 | high |
| CIS | 5.4.3.3 | direct | per OS, see the benchmark table | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-412035, UBTU-24-300030 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.