ROS (Robot Operating System)
TMA-ROS1-1.1.21
Ensure sticky bit is set on all world-writable directories
Deskripsi
Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them. The audit searches local filesystems for world-writable directories without the sticky bit and requires none. Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.
Cara pemeriksaan
Metode audit: Perintah shell
command -v findmnt >/dev/null 2>&1 || exit 1
mps=$(findmnt -rn -l -o TARGET,FSTYPE | awk '$2 !~ /^(nfs|nfs4|cifs|smb3|smbfs|fuse|proc|sysfs|tmpfs|devtmpfs|devpts|cgroup|cgroup2|pstore|securityfs|debugfs|tracefs|configfs|bpf|mqueue|hugetlbfs|autofs|binfmt_misc|efivarfs|overlay|squashfs|nsfs|ramfs|fusectl|rpc_pipefs)$/ {print $1}')
out=$(for m in $mps; do find "$m" -xdev -type d \( -perm -0002 -a \! -perm -1000 \) -print 2>/dev/null; done | sort -u | head -n 50)
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out"; echo 'world-writable directories without the sticky bit'; }- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Run the following command to set the sticky bit on all world writable directories: # df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | xargs -I '{}' chmod a+t '{}'
Properti
- Sistem operasi
- Apa saja
- Tag
- rosros1melodicsystem
- Referensi
- CIS ROS Melodic Benchmark v1.0.0 - 1.1.21 Ensure sticky bit is set on all world-writable directories
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target ros