documentation_complete: true

title: 'Ensure No World-Writable Files Exist'

description: |-
    It is generally a good idea to remove global (other) write access to a file when it is discovered.
    However, check with documentation for specific applications before making changes.
    Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account.

rationale: |-
    Data in world-writable files can be modified by any user on the system.
    In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.

severity: medium

references:
    nist: AC-6

ocil_clause: 'there is output'

ocil: |-
    To find world-writable files, run the following command:
    <pre>$ sudo find / -xdev -type f -perm -002</pre>
