Ensure the Default C Shell Umask is Set Correctly
Ensures the system-wide C shell startup file /etc/csh.cshrc sets a restrictive umask at least as strict as 0027.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
The umask determines the permissions stripped from newly created files and directories. /etc/csh.cshrc sets the system-wide umask for C shell / tcsh sessions; if it is too permissive, files created in those shells are group- or world-accessible by default, exposing data to unauthorized accounts. Setting the C shell umask at least as strict as 0027 enforces least privilege so that the protection cannot be bypassed simply by logging in with csh/tcsh instead of Bash.
What Pavois checks
Pavois reads the last effective umask line in /etc/csh.cshrc and tests it against 0027 with a bitmask comparison ((value & 0027) == 0027), so 0077 also passes. Taking the final matching line (tail -1) matches how a real csh/tcsh session resolves repeated assignments - covering this shell family closes a gap that file-only Bash checks would leave open. (This rule ships only on RHEL 8/9, where csh/tcsh are commonly present.)
describe command('v=$(grep -hiE \'^[[:space:]]*umask[[:space:]]+[0-7]+\' /etc/csh.cshrc 2>/dev/null | grep -oE \'[0-7]+\' | tail -1); { [ -n "$v" ] && [ $((0$v & 0077)) -eq $((0077)) ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Inspect the configured value:
grep -hiE '^[[:space:]]*umask[[:space:]]+[0-7]+' /etc/csh.cshrc | tail -1
Expected umask 027 (or stricter). Confirm at runtime with tcsh -c umask (expected 027 or 077).
Inspect & investigate
umask has no audit event; verify it from current state. Show the source line with grep -i umask /etc/csh.cshrc and the runtime value with tcsh -c umask. To see the resulting permissions of a new file, set the umask in a tcsh session then touch /tmp/t && stat -c '%a' /tmp/t.
Remediation
No automated harden plan is wired for this rule (remediation is empty), so it must be applied manually: add or correct a single umask 027 line in /etc/csh.cshrc, placed after any looser assignment so it is the effective one. New csh/tcsh sessions inherit it immediately; existing ones must re-login or re-source the file.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | grep -qE '^[[:space:]]*umask[[:space:]]+0?77' /etc/csh.cshrc || echo 'umask 077' >> /etc/csh.cshrc |
|---|---|
| name | umask-csh |
| not_if | grep -qE '^[[:space:]]*umask[[:space:]]+0?77' /etc/csh.cshrc |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk, scoped to C shell / tcsh users only - most modern RHEL deployments default to Bash, so few interactive sessions are affected. As with any umask tightening, scripts or tooling that create group-shared files from a csh environment may lose group access under 0077; audit such workflows and prefer setgid directories plus ACLs over loosening the global umask. The change affects only new files and is reversible by editing the line.