CCE-90228-8Platform: cpe:/o:apple:mac_os_x:10.10 | Date: (C)2015-06-23 (M)2023-07-04 |
Set the Global Umask Setting for Users
The default global umask setting must be set to '027' for user applications. The setting '027' ensures that user created files and directories will be readable, but not writable, by users that share the same group id. Users with a different group id will not be able to read or write those files. This mitigates the risk that unauthorized users might be able to read and write files saved to the system by user applications.
Parameter:
[Umask]
Technical Mechanism:
To view the umask setting, run the following command:
awk '{ print $2 }' /etc/launchd-user.conf
If the command produces an error, or the result is not '027', this is a finding.
CCSS Severity: | CCSS Metrics: |
CCSS Score : 8.4 | Attack Vector: LOCAL |
Exploit Score: 2.5 | Attack Complexity: LOW |
Impact Score: 5.9 | Privileges Required: NONE |
Severity: HIGH | User Interaction: NONE |
Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Scope: UNCHANGED |
| Confidentiality: HIGH |
| Integrity: HIGH |
| Availability: HIGH |
| |
References: Resource Id | Reference |
---|
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:25005 |