Ensure the Default Umask is Set Correctly in /etc/profile
Ensures /etc/profile (and any /etc/profile.d/*.sh drop-in) sets a restrictive umask at least as strict as 0027/0077 per norm.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The umask determines the permissions stripped from newly created files and directories. /etc/profile and its /etc/profile.d/*.sh drop-ins set the system-wide umask for login shells (and POSIX sh sessions). A permissive value here means files created by users default to group- or world-readable/writable, exposing data to unauthorized accounts. Enforcing at least 0027 (CIS) / 0077 (ANSSI BP-028 R36) applies least privilege to file creation for the login-shell path.
What Pavois checks
pavois scans both /etc/profile and every /etc/profile.d/*.sh drop-in, takes the last effective umask line (tail -1), and tests it against the norm target with a bitmask comparison ((value & mask) == mask), so 0077 satisfies 0027. Including the profile.d drop-ins is what a file-by-file check misses: many distributions ship the real umask in a drop-in (e.g. /etc/profile.d/umask.sh), and a later drop-in can override /etc/profile - reading the merged, last-wins result reflects what a login shell actually applies.
m = {'bp28'=>'0077','cis'=>'0027'}.fetch(input('pavois_standard', value: '_default'), '0077')
describe command("v=$(grep -hiE '^[[:space:]]*umask[[:space:]]+[0-7]+' /etc/profile /etc/profile.d/*.sh 2>/dev/null | grep -oE '[0-7]+' | tail -1); { [ -n \"$v\" ] && [ $((0$v & #{m})) -eq $((#{m})) ] && echo ok; } || echo ko") do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Inspect the effective configured value across all sources:
grep -hiE '^[[:space:]]*umask[[:space:]]+[0-7]+' /etc/profile /etc/profile.d/*.sh | tail -1
Expected umask 027 (or stricter). Confirm the runtime value in a login shell with bash -lc umask (expected 0027 or 0077).
Inspect & investigate
umask has no audit event; verify it from current state. List the source lines with grep -i umask /etc/profile /etc/profile.d/*.sh, and the value a login shell inherits with bash -lc umask. To check resulting file permissions, set the umask then touch /tmp/t && stat -c '%a' /tmp/t.
Remediation
No automated harden plan is wired for this rule (remediation is empty), so it must be applied manually: set umask 027 (or umask 077 for ANSSI) in /etc/profile or a dedicated /etc/profile.d/umask.sh, ensuring no later-sorted drop-in re-loosens it (drop-ins are sourced in lexical order). New login shells inherit it immediately; existing sessions must re-login.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | umask 077 |
|---|---|
| group | root |
| mode | 0755 |
| owner | root |
| path | /etc/profile.d/99-pavois-umask.sh |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk, scoped to login-shell sessions. As with the other umask sources, tightening to 0077 strips group access from newly created files, which can break workflows that rely on group-shared files (collaborative directories, web stacks expecting 0664/0775). Audit such cases before enforcing; where group sharing is needed, prefer setgid directories + ACLs over loosening the global umask. Beware drop-in ordering: a stricter /etc/profile value can still be overridden by a later profile.d file. The change affects only new files and is reversible by editing the line.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R36 | direct | 2.0 | high |
| CIS | 5.4.3.3 | direct | per OS, see the benchmark table | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-412035, UBTU-24-300030 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.