1.1.21 Ensure sticky bit is set on all world-writable directories

Information

Setting the sticky bit on world writable directories prevents users from deleting or
renaming files in that directory that are not owned by them.

Rationale:

This feature prevents the ability to delete or rename files in world writable directories
(such as /tmp ) that are owned by another user.

Solution

Run the following command to set the sticky bit on all world writable directories:

# df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev
-type d ( -perm -0002 -a ! -perm -1000 ) 2>/dev/null | xargs -I '{}' chmod
a+t '{}'

Notes:

Some distributions may not support the --local option to df.

See Also

https://workbench.cisecurity.org/files/2420

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv6|13, CSCv7|5.1

Plugin: Unix

Control ID: 9f4c560fa4167e8ec6b768d893fe8d15e3e8592b3511379e75a6b4a22774a4d5