documentation_complete: true

prodtype: rhel7,fedora

title: 'Ensure All World-Writable Directories Are Owned by a System Account'

description: |-
    All directories in local partitions which are
    world-writable should be owned by root or another
    system account.  If any world-writable directories are not
    owned by a system account, this should be investigated.
    Following this, the files should be deleted or assigned to an
    appropriate group.

rationale: |-
    Allowing a user account to own a world-writable directory is
    undesirable because it allows the owner of that directory to remove
    or replace any files that may be placed in the directory by other
    users.

severity: unknown

identifiers:
    cce@rhel7: 80136-5

references:
    disa: 366
    nist: AC-6
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "021030"

ocil_clause: 'there is output'

ocil: |-
    The following command will discover and print world-writable directories that
    are not owned by a system account, given the assumption that only system
    accounts have a uid lower than 500.  Run it once for each local partition <i>PART</i>:
    <pre>$ sudo find <i>PART</i> -xdev -type d -perm -0002 -uid +499 -print</pre>
