documentation_complete: true


title: 'Ensure sudo umask is appropriate - sudo umask'

description: |-
    The sudo <tt>umask</tt> tag, when specified, will be added the to the user's umask in the
    command environment.
{{%- if 'rhel' in product or 'ol' in families %}}
    On {{{ full_name }}}, the default <tt>umask</tt> value is 0022.
{{% endif %}}
    The umask should be configured by making sure that the <tt>umask={{{ xccdf_value("var_sudo_umask") }}}</tt> tag exists in
    <tt>/etc/sudoers</tt> configuration file or any sudo configuration snippets
    in <tt>/etc/sudoers.d/</tt>.

rationale: |-
    The umask value influences the permissions assigned to files when they are created.
    A misconfigured umask value could result in files with excessive permissions that can be read or
    written to by unauthorized users.

severity: medium

identifiers:
    cce@rhel8: CCE-83860-7
    cce@sle12: CCE-91498-6
    cce@sle15: CCE-91189-1


ocil_clause: 'umask is not set with the appropriate value for sudo'

ocil: |-
    To determine if <tt>umask</tt> has been configured for sudo with the appropriate value,
    run the following command:
    <pre>$ sudo grep -ri '^Defaults.*umask={{{ xccdf_value("var_sudo_umask") }}}' /etc/sudoers /etc/sudoers.d/</pre>
    The command should return a matching output.

template:
    name: sudo_defaults_option
    vars:
        option: umask
        variable_name: "var_sudo_umask"