Ensure sticky bit is set on all world-writable directories

SedangLevel 1Otomatislinux

Deskripsi

Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { command -v awk >/dev/null 2>&1 || { echo "step1: awk not installed"; return 1; }; command -v df >/dev/null 2>&1 || { echo "step1: df not installed"; return 1; }; command -v xargs >/dev/null 2>&1 || { echo "step1: xargs not installed"; return 1; }; o=$(bash -c 'df --local -P | awk {'"'"'if (NR!=1) print $6'"'"'} | xargs -I '"'"'{}'"'"' find '"'"'{}'"'"' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'No output should be returned.' || { echo step1: missing 'No output should be returned.'; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following command to set the sticky bit on all world writable directories: # df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t

Properti

Sistem operasi: alinux-2
Tag: cis-convertedlinux
Referensi: CIS Aliyun Linux 2 Benchmark v1.0.0 ARCHIVE - 1.1.18

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target linux