5.1.3 Check System folder for world writable files

Information

Software sometimes insists on being installed in the /System Directory and have inappropriate world writable permissions.

Rationale:

Folders in /System should not be world writable. The audit check excludes the 'Drop Box' folder that is part of Apple's default user template.

Solution

Run the following command to set permissions so that folders are not world writable in the /System folder:

$ sudo chmod -R o-w /Path/<baddirectory>

example:

$ sudo chmod -R o-w /System/Library/baddir

See Also

https://workbench.cisecurity.org/files/3013

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6

Plugin: Unix

Control ID: a99a199efd8049c149ef42c9bd540041b85d8508225571c2ed75bca909e0be5a