TMA-ROS1-1.1.21

Ensure sticky bit is set on all world-writable directories

СредњаНиво 1Аутоматскаros

Опис

Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them. The audit searches local filesystems for world-writable directories without the sticky bit and requires none. Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

Како се проверава

Метод провере: Команда љуске

shell

command -v findmnt >/dev/null 2>&1 || exit 1
mps=$(findmnt -rn -l -o TARGET,FSTYPE | awk '$2 !~ /^(nfs|nfs4|cifs|smb3|smbfs|fuse|proc|sysfs|tmpfs|devtmpfs|devpts|cgroup|cgroup2|pstore|securityfs|debugfs|tracefs|configfs|bpf|mqueue|hugetlbfs|autofs|binfmt_misc|efivarfs|overlay|squashfs|nsfs|ramfs|fusectl|rpc_pipefs)$/ {print $1}')
out=$(for m in $mps; do find "$m" -xdev -type d \( -perm -0002 -a \! -perm -1000 \) -print 2>/dev/null; done | sort -u | head -n 50)
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out"; echo 'world-writable directories without the sticky bit'; }

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Run the following command to set the sticky bit on all world writable directories: # df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d $ -perm -0002 -a ! -perm -1000 $ 2>/dev/null | xargs -I '{}' chmod a+t '{}'

Својства

Оперативни системи: Било који
Ознаке: rosros1melodicsystem
Референца: CIS ROS Melodic Benchmark v1.0.0 - 1.1.21 Ensure sticky bit is set on all world-writable directories

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target ros