STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The sticky bit must be set on all public directories.

DISA Rule

SV-209038r603263_rule

Vulnerability Number

V-209038

Group Title

SRG-OS-000480

Rule Version

OL6-00-000336

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory.

Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit.

However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes.

To set the sticky bit on a world-writable directory [DIR], run the following command:

# chmod +t [DIR]

Check Contents

To find world-writable directories that lack the sticky bit, run the following command for each local partition [PART]:

# find [PART] -xdev -type d -perm -002 ! -perm -1000

If any world-writable directories are missing the sticky bit, this is a finding.

Vulnerability Number

V-209038

Documentable

False

Rule Version

OL6-00-000336

Severity Override Guidance

To find world-writable directories that lack the sticky bit, run the following command for each local partition [PART]:

# find [PART] -xdev -type d -perm -002 ! -perm -1000

If any world-writable directories are missing the sticky bit, this is a finding.

Check Content Reference

M

Target Key

2928

Comments