cis-ubuntu2004-v300-7-1-11

name	cis-ubuntu2004-v300-7-1-11
description	Ensure world writable files and directories are secured
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","file-permissions"]
cis_id	7.1.11
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

7.1.11 Ensure world writable files and directories are secured (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

World writable files are the least secure. Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity. See the chmod(2) man page for more information.

Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.

Rationale

Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity.

This feature prevents the ability to delete or rename files in world writable directories (such as /tmp) that are owned by another user.

Impact

None

Audit Procedure

Command Line

Run the following script to verify:

• No world writable files exist
• No world writable directories without the sticky bit exist

#!/usr/bin/env bash

{
    l_output="" l_output2=""
    l_smask='01000'
    a_file=(); a_dir=() # Initialize arrays
    a_path=(! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "*/kubelet/plugins/*" -a ! -path "/sys/*" -a ! -path "/snap/*")
    while IFS= read -r l_mount; do
        while IFS= read -r -d $'\0' l_file; do
            if [ -e "$l_file" ]; then
                [ -f  ] && a_file+=() 
                 [ -d  ];  
                    l_mode=
                    [ ! $((  &  )) -gt 0 ] && a_dir+=()
                
            
         < <(find  -xdev \(  \) \( - f -o - d \) -perm -0002 -print0 2>/dev/null)
     < <(findmnt -Dkerno fstype,target | awk )
     ! ((  >  )); 
        l_output=
    
        l_output2=
    
     ! ((  >  )); 
        l_output=
    
        l_output2=
    
     a_path;  a_arr;  a_file;  a_dir 
    
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}