STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must set the umask value to "077" for all local interactive user accounts.

DISA Rule

SV-281079r1165592_rule

Vulnerability Number

V-281079

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

RHEL-10-400310

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure RHEL 10 to set the umask value for all local interactive user accounts to "077".

Remove the umask statement from all local interactive users' initialization files.

If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the information system security officer. However, the user agreement for access to the account must specify that the local interactive user must log in to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.

Check Contents

Verify RHEL 10 sets the default umask for all local interactive users to "077".

Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file.

Check all local interactive user initialization files for interactive users with the following command:

Note: The example is for a system that is configured to create users' home directories in the "/home" directory.

$ sudo find /home -maxdepth 2 -type f -name ".[^.]*" -exec grep -iH -d skip --exclude=.bash_history umask {} \;
/home/disauser/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile
/home/disauser/.bash_history:grep -i umask /etc/login.defs

If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.

Vulnerability Number

V-281079

Documentable

False

Rule Version

RHEL-10-400310

Severity Override Guidance

Verify RHEL 10 sets the default umask for all local interactive users to "077".

Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file.

Check all local interactive user initialization files for interactive users with the following command:

Note: The example is for a system that is configured to create users' home directories in the "/home" directory.

$ sudo find /home -maxdepth 2 -type f -name ".[^.]*" -exec grep -iH -d skip --exclude=.bash_history umask {} \;
/home/disauser/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile
/home/disauser/.bash_history:grep -i umask /etc/login.defs

If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.

Check Content Reference

M

Target Key

5733