Ensure world writable files and directories are secured

보통레벨 1자동linux

설명

World writable files are the least secure. Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity. See the chmod(2) man page for more information. Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.

점검 방법

감사 방식: 셸 명령

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_path=(-path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "*/docker/*" -o -path "/sys/*" -o -path "/snap/*" -o - path "/boot/efi/*")
   while IFS= read -r l_mount; do
      find "$l_mount" -mount -xdev \( "${a_path[@]}" \) -prune -o \
         \( \( -type f -perm -0002 \) -o \( -type d -perm -0002 ! -perm -1000 \) \) \
         -printf '"'"'%y %p\n'"'"' 2>/dev/null
   done < <(findmnt -Dkerno fstype,target | awk '"'"'($1 !~ /^[[:space:]]*(nfs|proc|cifs|smb|vfat|iso9660|efivarfs|selinuxfs|ncpfs)/ && $2 !~ /^(\/run|\/tmp|\/var\/tmp)(\/|$)/){print $2}'"'"')
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

• World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. • World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: • Remove other write permission from any world writable files • Add the sticky bit to all world writable directories #!/usr/bin/env bash { l_smask='01000' a_file=() a_dir=() a_path=(-path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "*/docker/*" -o -path "/sys…

속성

운영 체제: almalinux-9
태그: cis-convertedlinux
참고 자료: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 7.1.11

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux