Ensure world writable files and directories are secured

Trung bìnhCấp 1Tự độnglinux

Mô tả

World writable files are the least secure. Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity. See the chmod(2) man page for more information. Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_path=(-path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "*/docker/*" -o -path "/sys/*" -o -path "/snap/*" -o - path "/boot/efi/*")
   while IFS= read -r l_mount; do
      find "$l_mount" -mount -xdev \( "${a_path[@]}" \) -prune -o \
         \( \( -type f -perm -0002 \) -o \( -type d -perm -0002 ! -perm -1000 \) \) \
         -printf '"'"'%y %p\n'"'"' 2>/dev/null
   done < <(findmnt -Dkerno fstype,target | awk '"'"'($1 !~ /^[[:space:]]*(nfs|proc|cifs|smb|vfat|iso9660|efivarfs|selinuxfs|ncpfs)/ && $2 !~ /^(\/run|\/tmp|\/var\/tmp)(\/|$)/){print $2}'"'"')
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

• World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. • World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: • Remove other write permission from any world writable files • Add the sticky bit to all world writable directories #!/usr/bin/env bash { l_smask='01000' a_file=() a_dir=() a_path=(-path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "*/docker/*" -o -path "/sys…

Thuộc tính

Hệ điều hành: rhel-9
Thẻ: cis-convertedlinux
Tham chiếu: CIS Red Hat Enterprise Linux 9 Benchmark v3.0.0 - 7.1.11

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target linux