Oracle Linux 8 Security Technical Implementation Guide

The Oracle Linux 8 Security Technical Implementation Guide (V2 R10) has 378 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

378STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R10

CurrentPublished Wed Sep 30 2026

OL 8 default permissions must be defined in such a way that all authenticated users can read and modify only their own files.

Oracle Linux 8 Security Technical Implementation Guide

Assessment Title

Rule Text

OL 8 default permissions must be defined in such a way that all authenticated users can read and modify only their own files.

Description

Discussion Text

Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-248719

Rule

SV-248719r991590_rule

Severity

medium

Rule Version

OL08-00-020351

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify OL 8 defines default permissions for all authenticated users in such a way that the user can read and modify only their own files with the following command: 
 
$ sudo grep -i "umask" /etc/login.defs 
 
UMASK 077 
 
If the "UMASK" variable is set to "000", this is a finding with the severity raised to a CAT I. 
 
If the value of "UMASK" is not set to "077", "UMASK" is commented out, or "UMASK" is missing completely, this is a finding.

Implementation Procedure

Fix Text

Configure OL 8 to define the default permissions for all authenticated users in such a way that the user can read and modify only their own files. 
 
Edit the "UMASK" parameter in the "/etc/login.defs" file to match the example below: 
 
UMASK 077

STIG check 179 of 378 in the Oracle Linux 8 STIG checklist

← Previous · V-248718OL 8 must display the date and time of the last successful account logon upon an SSH logon.Next · V-248720 →OL 8 must set the umask value to 077 for all local interactive user accounts.