1.1.21 Ensure sticky bit is set on all world-writable directories

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This feature prevents the ability to delete or rename files in world writable directories (such as /tmp) that are owned by another user.

Solution

Run the following command to set the sticky bit on all world writable directories: # df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t

See Also

https://workbench.cisecurity.org/files/1859

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3(3), CSCv6|13

Plugin: Unix

Control ID: ec036364d39aa8a7014fa19d9dd6846a6869f846fb746c2ac5644f040e4be23a