TMA-ROS1-1.1.21
Ensure sticky bit is set on all world-writable directories
Descrição
Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them. The audit searches local filesystems for world-writable directories without the sticky bit and requires none. Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.
Como é verificado
Método de auditoria: Comando shell
command -v findmnt >/dev/null 2>&1 || exit 1
mps=$(findmnt -rn -l -o TARGET,FSTYPE | awk '$2 !~ /^(nfs|nfs4|cifs|smb3|smbfs|fuse|proc|sysfs|tmpfs|devtmpfs|devpts|cgroup|cgroup2|pstore|securityfs|debugfs|tracefs|configfs|bpf|mqueue|hugetlbfs|autofs|binfmt_misc|efivarfs|overlay|squashfs|nsfs|ramfs|fusectl|rpc_pipefs)$/ {print $1}')
out=$(for m in $mps; do find "$m" -xdev -type d \( -perm -0002 -a \! -perm -1000 \) -print 2>/dev/null; done | sort -u | head -n 50)
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out"; echo 'world-writable directories without the sticky bit'; }- Saída esperada
compliant
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Run the following command to set the sticky bit on all world writable directories: # df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | xargs -I '{}' chmod a+t '{}'
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- rosros1melodicsystem
- Referência
- CIS ROS Melodic Benchmark v1.0.0 - 1.1.21 Ensure sticky bit is set on all world-writable directories
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target ros