LowOS hardeningBLWK-ACCT-005

Default UMASK is not explicitly configured

What this means

No default umask is configured — neither an explicit UMASK line in /etc/login.defs nor a pam_umask entry in /etc/pam.d. Without a deliberate value, new files created by shells that don't set their own umask fall back to whatever the system default happens to be — commonly 022, which leaves new files group/world-readable by default rather than requiring an explicit opt-in to share them.

How to fix it

Set UMASK 027 (or your organization's policy) in /etc/login.defs, or add pam_umask to the session stack.

Check it yourself

Run a scan and look for BLWK-ACCT-005 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads login_defs and reports this check when:

umask_configured == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 6.2.3

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• A sensitive system file is world-writable · BLWK-FS-001
• /etc/shadow is world-readable · BLWK-FS-002