1.1.21 Ensure sticky bit is set on all world-writable directories

Information

Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.

Rationale:

This feature prevents the ability to delete or rename files in world writable directories (such as /tmp ) that are owned by another user.

Solution

Run the following command to set the sticky bit on all world writable directories:

# df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t

Notes:

Some distributions may not support the --local option to df.

See Also

https://workbench.cisecurity.org/files/2619

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(10), CSCv7|13

Plugin: Unix

Control ID: fcc055091a8f220a2ee19fe2276e0d8c1e523353765447d9b71a6a928db1000b