documentation_complete: true

prodtype: rhel7,fedora,ol7

title: 'Verify that All World-Writable Directories Have Sticky Bits Set'

description: |-
    When the so-called 'sticky bit' is set on a directory,
    only the owner of a given file may remove that file from the
    directory. Without the sticky bit, any user with write access to a
    directory may remove any file in the directory. Setting the sticky
    bit prevents users from removing each other's files. In cases where
    there is no reason for a directory to be world-writable, a better
    solution is to remove that permission rather than to set the sticky
    bit. However, if a directory is used by a particular application,
    consult that application's documentation instead of blindly
    changing modes.
    <br />
    To set the sticky bit on a world-writable directory <i>DIR</i>, run the
    following command:
    <pre>$ sudo chmod +t <i>DIR</i></pre>

rationale: "Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.\n<br /><br />\nThe only authorized public directories are those temporary directories supplied with the system, \nor those designed to be temporary file repositories.  The setting is normally reserved for directories \nused by the system, by users for temporary file storage (such as <tt>/tmp</tt>), and for directories \nrequiring global read/write access."

severity: unknown

identifiers:
    cce@rhel7: 80130-8

references:
    cis: 1.1.21
    nist: AC-6

ocil_clause: 'any world-writable directories are missing the sticky bit'

ocil: |-
    To find world-writable directories that lack the sticky bit, run the following command:
    <pre>$ sudo find / -xdev -type d -perm 002 ! -perm 1000</pre>
