STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 must set the umask value to 077 for all local interactive user accounts.

DISA Rule

SV-282722r1201146_rule

Vulnerability Number

V-282722

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

TOSS-05-000294

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Remove the umask statement from all local interactive user's initialization files.

If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the information system security officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.

Check Contents

Verify the default umask for all local interactive users is "077".

Identify the locations of all local interactive user home directories in the "/etc/passwd" file.

Check all local interactive user initialization files for interactive users using the following command.

Note: The example is for a system that is configured to create users home directories in the "/home" directory.

# grep -ri umask /home/

/home/wadea/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile
/home/wadea/.bash_history:grep -i umask /etc/login.defs

If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.

Vulnerability Number

V-282722

Documentable

False

Rule Version

TOSS-05-000294

Severity Override Guidance

Check Content Reference

Target Key

5738