STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

RHEL 8 must define default permissions for logon and non-logon shells.

DISA Rule

SV-230385r1017194_rule

Vulnerability Number

V-230385

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

RHEL-08-020353

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

Add or edit the lines for the "UMASK" parameter in the "/etc/bashrc", "/etc/csh.cshrc" and "/etc/profile"files to "077":

UMASK 077

Check Contents

Verify that the umask default for installed shells is "077".

Check for the value of the "UMASK" parameter in the "/etc/bashrc", "/etc/csh.cshrc" and "/etc/profile" files with the following command:

Note: If the value of the "UMASK" parameter is set to "000" in the "/etc/bashrc" the "/etc/csh.cshrc" or the "/etc/profile" files, the Severity is raised to a CAT I.

# grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile

/etc/bashrc: umask 077
/etc/bashrc: umask 077
/etc/csh.cshrc: umask 077
/etc/csh.cshrc: umask 077
/etc/profile: umask 077
/etc/profile: umask 077

If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing or is commented out, this is a finding.

Vulnerability Number

V-230385

Documentable

False

Rule Version

RHEL-08-020353

Severity Override Guidance

Check Content Reference

Target Key

2921