Patch summary:
The current implementation of accounts_umask_etc_profile check is checking
just the first occurrence of umask keyword in /etc/profile file. But the last
occurrence is the one that's actually applied. This can be checked via having:
umask 077
umask 022
in /etc/profile, login to a new log-in session for particular user (su - $USER),
and running "umask" command without arguments (the last setting, e.g. 0022 is
reported as
the actual umask value used for file creation. Can be verified by checking mode
of newly created file in that session).
So instead of checking just first value (and possibly reporting false-negative
test result), check all occurrences (and report proper result).
Testing report:
The patch has been tested on RHEL-6 & works properly.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team