mediumfilesystemverified ✓rollback-safe
Set sticky bit on world-writable directories
sticky-bit-world-writable · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
World-writable directories should have the sticky bit set to prevent users from deleting or renaming files owned by other users.
Rationale
Without the sticky bit, any user can delete or rename files in a world-writable directory, even files they don't own. The sticky bit ensures only the file owner can delete their files.
Check → Remediate
Checkcommand
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | head -1 | grep -q . && exit 1 || exit 0
- expected_exit:
- 0
Remediatefile_permissions
- find_paths:
- /
- find_type:
- d
- find_args:
- -xdev -perm -0002 ! -perm -1000
- mode:
- +t
- unless:
- ! find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | grep -q .
Framework references
STIG
V-281073 / RHEL-10-400280V-257929 / RHEL-09-232245V-230243 / RHEL-08-010190V-270750 / UBTU-24-600150V-260513 / UBTU-22-232145
NIST 800-53
AC-6CM-6
Live verification
ubuntu22:checkubuntu24:check
#permissions#sticky-bit#world-writable#security