Ensure world writable directories have the SVTX bit set

Cómo se verifica

Método de auditoría: Comando de shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find / \( -fstype jfs -o -fstype jfs2 \) -type d -perm -o+w ! -perm -1000 -ls ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Review the local mounted JFS/JFS2 filesystems using the following command to find all world writable directories missing the SVTX bit: find / \( -fstype jfs -o -fstype jfs2 \) -type d -perm -o+w ! -perm -1000 -ls If a directory must retain world writable access, ensure that SVTX bit is set so that users can only remove the filenames they own: chmod o+t ${dir} NOTE: This will leave existing modes while adding the SVTX (also known as sticky bit) to the directory. The documented meaning of the flag for directories is: Sets the link permission to directories. Otherwise, remove world-write permission - without modifying the other mode bits: chmod o-w ${dir}

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target aix