TMA-ROS1-1.1.21
Ensure sticky bit is set on all world-writable directories
Description
Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them. The audit searches local filesystems for world-writable directories without the sticky bit and requires none. Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.
How it is checked
Audit method: Shell command
command -v findmnt >/dev/null 2>&1 || exit 1
mps=$(findmnt -rn -l -o TARGET,FSTYPE | awk '$2 !~ /^(nfs|nfs4|cifs|smb3|smbfs|fuse|proc|sysfs|tmpfs|devtmpfs|devpts|cgroup|cgroup2|pstore|securityfs|debugfs|tracefs|configfs|bpf|mqueue|hugetlbfs|autofs|binfmt_misc|efivarfs|overlay|squashfs|nsfs|ramfs|fusectl|rpc_pipefs)$/ {print $1}')
out=$(for m in $mps; do find "$m" -xdev -type d \( -perm -0002 -a \! -perm -1000 \) -print 2>/dev/null; done | sort -u | head -n 50)
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out"; echo 'world-writable directories without the sticky bit'; }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run the following command to set the sticky bit on all world writable directories: # df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | xargs -I '{}' chmod a+t '{}'
Properties
- Operating systems
- Any
- Tags
- rosros1melodicsystem
- Reference
- CIS ROS Melodic Benchmark v1.0.0 - 1.1.21 Ensure sticky bit is set on all world-writable directories
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target ros