# Ensure local interactive user dot files access is configured

The user file-creation mode mask (umask) determines the default permissions for newly created files and directories. An overly permissive umask (e.g., 022 or 002) could allow other local users on a multi-user system to read, modify, or execute a user's private files, including sensitive configuration 'dotfiles' in their home directory. This misconfiguration can lead to unauthorized information disclosure, data tampering, and potential pathways for privilege escalation. The audit script verifies the system-wide default umask setting in `/etc/login.defs`, which governs non-system user sessions. The remediation script modifies this file to enforce a more secure default permission mask. The Basic state of '027' is a widely accepted security baseline (CIS recommendation) that prevents new files from being world-readable while allowing group members to read, suitable for collaborative environments. The Moderate and Strict state of '077' provides maximum protection by ensuring that, by default, only the file owner has any permissions, completely isolating a user's files from all other accounts on the system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['027']` |
| **Moderate** | `['077']` |
| **Strict** | `['077']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that searches the `/etc/login.defs` file for the line defining `UMASK`, ignoring commented lines and leading whitespace. The script must extract the numerical value (e.g., 027) and print only this value to standard output.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired umask value (e.g., '077'). The script must update the `UMASK` setting in the `/etc/login.defs` file. It should handle modifying an existing `UMASK` line, uncommenting and setting a commented one, or adding the setting if it does not exist. The script must output `true` on successful modification and `false` otherwise.

