Ensure sticky bit is set on all world-writable directories

MediumLevel 1Automatedlinux

Description

Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.

How it is checked

Audit method: Shell command

shell

alt0() { command -v awk >/dev/null 2>&1 || { echo "step1: awk not installed"; return 1; }; command -v df >/dev/null 2>&1 || { echo "step1: df not installed"; return 1; }; command -v xargs >/dev/null 2>&1 || { echo "step1: xargs not installed"; return 1; }; o=$(bash -c 'df --local -P | awk {'"'"'if (NR!=1) print $6'"'"'} | xargs -I '"'"'{}'"'"' find '"'"'{}'"'"' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'No output should be returned.' || { echo step1: missing 'No output should be returned.'; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following command to set the sticky bit on all world writable directories: # df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t

Properties

Operating systems: alinux-2
Tags: cis-convertedlinux
Reference: CIS Aliyun Linux 2 Benchmark v1.0.0 ARCHIVE - 1.1.18

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux