Ensure Access to Special Purpose Application Writable Directories is Properly Restricted

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Perform the following to determine if the recommended state is implemented: 1. Single Purpose Directory - For each application writable directory review the documented purpose for the directory to confirm the directory serves a single purpose. 2. Outside the Configured Web DocumentRoot - For each writable directory and it's corresponding DocumentRoot perform the following. No output from the find command indicates the directory is not within the DocumentRoot.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Perform the following: 1. Single Purpose Directory - Create separate directories of the multipurpose directory, and adjust the application configuration and directory ownership and permissions appropriately. 2. Outside the Configured Web DocumentRoot - Move the writable directory to a more suitable location NOT under the DocumentRoot directory. A location within the /var/ filesystem may be a good choice for changeable data. 3. Owned by the root User or an Administrator Account - Change the ownership to root or an administrator. chown root $WR_DIR 4. Not writable by Other - Remove the other write permissions, use group write or ACLs to provide the least privileges necessary. chmod o-w $WR_DIR