The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.solaris11:def:49
# The default umask for system and users must be 077.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
# - textfilecontent54_object (textfilecontent54_test) -- Check the umask setting in every user initialization file to make sure it is 077.: no extractor for field "subexpression"
# Check the umask setting in the default login file to make sure it is 077.
# textfilecontent54_object (textfilecontent54_test)
test_2() {
(sed -En 's/^\s*UMASK=(\S+)\s*$/\1/p' '/etc/default/login') | grep -qxF '077'
}
# Check each user account to make sure each has a .profile user initialization file.
# password_object (password_test)
test_3() {
! ( getent passwd ^[^-+].*$ &>/dev/null )
}
if ( test_2 && test_3 ); then
echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
echo "FAIL (or see MANUAL REVIEW note above)"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# OVAL definition: oval:mil.disa.stig.solaris11:def:49
if [ ! -f "/etc/default/login" ]; then echo "PASS"; exit 0; fi
if grep -qE "^\\s*UMASK=(\\S+)\\s*$" /etc/default/login && echo "$MATCH" | grep -qE "077$"; then :; else echo "FAIL"; exit 1; fi
for user in $(getent passwd | cut -d: -f1); do
if [ ! -f "/home/$user/.profile" ]; then :; else
if grep -qE "^\\s*umask\\s+(\\S+)\\s*$" /home/$user/.profile && echo "$MATCH" | grep -qE "077$"; then :; else echo "FAIL"; exit 1; fi
fi
done
echo "PASS"; exit 0