Detections
Analytics
5.1 Set Sticky Bit on World Writable Directories
Information
When the so-called sticky bit (set with chmod +t) is set on a directory, then only the owner of a file may remove that file from the directory (as opposed to the usual behavior where anybody with write access to that directory may remove the file).Files in directories that have had the 'sticky bit' set, can only be deleted by users that have both write permissions for the directory in which the file resides, as well as ownership of the file or directory, or has sufficient privilege. As this prevents users from overwriting each other's files, whether it be accidental or malicious, it is generally appropriate for most world-writable directories (e.g., /tmp). However, consult appropriate vendor documentation before blindly applying the sticky bit to any world writable directories found, in order to avoid breaking any application dependencies on a given directory.
Solution
To set the sticky bit on a directory, run the following command:# chmod +t [directory name]
See Also
Item Details
Audit Name: CIS Solaris 11.1 L1 v1.0.0
Category: ACCESS CONTROL
References: 800-53|AC-6
Plugin: Unix
Control ID: 05b07f8309961e7f4a858ca05d4dc32bf3b43a662d6d782cdb39c30489461281