Ensure world writable files and directories are secured

How it is checked

Audit method: Shell command

command -v find >/dev/null 2>&1 || exit 1; out=$( { find / \( -path /tmp -o -path /proc \) -prune -o -type f -perm -o=w -print; find / \( -path /tmp -o -path /proc \) -prune -o -type d -perm -o=w ! -perm -1000 -print ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: Remove other write permission from any world writable files Add the sticky bit to all world writable directories #!/bin/sh # Define paths to exclude (space-separated) a_path_exclusions="! -path '/tmp/*' ! -path '/proc/*'" # Fix world-writable files by removing the write permission for "others" find / \( $a_path_exclusions \) -type f -perm -o=w -print -exec chmod o-w {} \; # Fix world-writable directories without the sticky bit find / \( $a_path_exclusions \) -type d -perm -o=w ! -perm -1000 -print -exec chmod +t,o-w {} \;

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target freebsd