← Rules Catalog
mediumfilesystemverified rollback-safe

Set sticky bit on world-writable directories

sticky-bit-world-writable · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl

Description

World-writable directories should have the sticky bit set to prevent users from deleting or renaming files owned by other users.

Rationale

Without the sticky bit, any user can delete or rename files in a world-writable directory, even files they don't own. The sticky bit ensures only the file owner can delete their files.

Check → Remediate

Checkcommand
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | head -1 | grep -q . && exit 1 || exit 0
expected_exit:
0
Remediatefile_permissions
find_paths:
/
find_type:
d
find_args:
-xdev -perm -0002 ! -perm -1000
mode:
+t
unless:
! find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | grep -q .

Framework references

STIG

V-281073 / RHEL-10-400280V-257929 / RHEL-09-232245V-230243 / RHEL-08-010190V-270750 / UBTU-24-600150V-260513 / UBTU-22-232145

NIST 800-53

AC-6CM-6

Live verification

ubuntu22:checkubuntu24:check
#permissions#sticky-bit#world-writable#security