Ensure world writable files and directories are secured

Cómo se verifica

Método de auditoría: Comando de shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_path=(-path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "*/docker/*" -o -path "/sys/*" -o -path "/snap/*" -o - path "/boot/efi/*")
   while IFS= read -r l_mount; do
      find "$l_mount" -mount -xdev \( "${a_path[@]}" \) -prune -o \
         \( \( -type f -perm -0002 \) -o \( -type d -perm -0002 ! -perm -1000 \) \) \
         -printf '"'"'%y %p\n'"'"' 2>/dev/null
   done < <(findmnt -Dkerno fstype,target | awk '"'"'($1 !~ /^[[:space:]]*(nfs|proc|cifs|smb|vfat|iso9660|efivarfs|selinuxfs|ncpfs)/ && $2 !~ /^(\/run|\/tmp|\/var\/tmp)(\/|$)/){print $2}'"'"')
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

• World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. • World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: • Remove other write permission from any world writable files • Add the sticky bit to all world writable directories #!/usr/bin/env bash { l_smask='01000' a_file=() a_dir=() a_path=(-path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "*/docker/*" -o -path "/sys…

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target linux