# Ensure root user umask is configured

Necessity: The 'umask' (user file-creation mode mask) utility sets the default file permissions for newly created files and directories. For the root user, a permissive umask could result in the creation of world-writable or group-writable system files, posing a significant security risk. An attacker with access to a non-privileged account could potentially modify these files to escalate privileges, disclose sensitive information, or cause a denial of service. Enforcing a restrictive umask for root is a critical step in securing the file system.

Auditing and Remediation: The audit script inspects system-wide shell configuration files, such as `/etc/bashrc` and `/etc/profile`, to determine the currently configured umask for the root user. The remediation script modifies these same files, either by updating an existing `umask` entry within the root user's conditional block (if [ $UID -eq 0 ]) or by adding one, to enforce the desired secure value.

Recommended State Rationale: 
- Basic/Moderate: A umask of '027' is recommended as a strong security baseline, aligning with CIS Benchmark standards. This setting ensures that files created by root are not readable, writable, or executable by 'other' users, and not writable by group members. This greatly reduces the attack surface while still allowing group members to read or execute files where necessary, maintaining a balance between security and operational functionality.
- Strict: A umask of '077' provides the highest level of security. It prevents any user other than root (including group members) from having any permissions (read, write, or execute) on newly created files by default. This configuration adheres to the principle of least privilege in its strictest sense and is recommended for high-security environments where any potential for unauthorized data access must be eliminated. Administrators must explicitly grant permissions using `chmod` if a file needs to be shared.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['027']` |
| **Moderate** | `['027']` |
| **Strict** | `['077']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the `/etc/bashrc` and `/etc/profile` files for the configured umask for the root user (UID 0). The script should parse these files to find the active `umask` value and print only the octal value (e.g., '027') to standard output, without any additional text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument representing the desired umask value (e.g., '027'). The script should find and update the existing umask setting for the root user (UID 0) within a conditional block in `/etc/bashrc` and `/etc/profile`, or add the setting if it does not exist. The script must output 'true' on successful modification and 'false' if it fails.

