# Ensure root user umask is configured

Necessity: The user file-creation mode mask (umask) determines the default permissions for newly created files and directories. For the root user, an overly permissive umask (e.g., 002) could result in sensitive system files or scripts being created with world-writable permissions. This could allow an unprivileged user to modify critical files, potentially leading to privilege escalation, denial of service, or unauthorized data access.

Auditing and Remediation: The audit script inspects the root user's shell configuration files (e.g., /root/.profile, /root/.bashrc) to determine the configured umask value. The remediation script modifies these files to set the umask to a secure value, ensuring that all subsequent files created by the root user adhere to the principle of least privilege by default.

Recommended State Rationale: 
- Basic ('022'): This is a common default that prevents users outside of the file's group from writing to it. It provides a baseline level of protection against accidental modification.
- Moderate ('027'): This state, often recommended by security benchmarks like CIS, is significantly more secure. It removes write permissions for group members and all permissions (read, write, execute) for others. This greatly restricts access to root-created files, preventing potential information disclosure or modification by other users on the system.
- Strict ('077'): This is the most secure configuration. It ensures that any new file created by root is accessible only by root, removing all default permissions for group and other users. This enforces maximum isolation and confidentiality, which is critical in high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['022']` |
| **Moderate** | `['027']` |
| **Strict** | `['077']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks for the `umask` setting in both `/root/.profile` and `/root/.bashrc`. The script should prioritize the value from `/root/.bashrc` if it exists in both. It must extract and return only the numeric umask value (e.g., '027'). If no umask is explicitly set in either file, the script should return an empty string.

## Remediation Script Working

shell script that accepts a single positional argument representing the desired umask value (e.g., '027'). The script should first check for an existing 'umask' setting in `/root/.profile` and `/root/.bashrc`. If found, it must update the value. If not found, it must add 'umask [value]' to `/root/.profile`. The script must return 'true' upon successful modification or if the setting is already correct, and 'false' on failure.

