STIGQter STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must set the sticky bit for world-writable directories.

DISA Rule

SV-257551r1137645_rule

Vulnerability Number

V-257551

Group Title

SRG-APP-000243-CTR-000600

Rule Version

CNTR-OS-000590

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Fix the directory permissions, by either removing world-writeable permission, or setting the sticky bit by executing the following:

oc debug node/<node_name> -- chroot /host /bin/bash -c 'chmod XXXX <directory>'

where
node_name: The name of the node to connect to (oc get node)
XXXX: Either 1777 (sticky bit) or 0755 (remove group and world write permission)
<directory>: The directory on which to correct the permissions

Check Contents

Verify that all world-writable directories have the sticky bit set. List any world-writeable directories that do not have the sticky bit set by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; find / -type d \( -perm -0002 -a ! -perm -1000 ! -path "/var/lib/containers/*" ! -path "/var/lib/kubelet/pods/*" ! -path "/sysroot/ostree/deploy/*" \) -print 2>/dev/null' 2>/dev/null; done

If there are any directories listed in the results, this is a finding.

Vulnerability Number

V-257551

Documentable

False

Rule Version

CNTR-OS-000590

Severity Override Guidance

Verify that all world-writable directories have the sticky bit set. List any world-writeable directories that do not have the sticky bit set by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; find / -type d \( -perm -0002 -a ! -perm -1000 ! -path "/var/lib/containers/*" ! -path "/var/lib/kubelet/pods/*" ! -path "/sysroot/ostree/deploy/*" \) -print 2>/dev/null' 2>/dev/null; done

If there are any directories listed in the results, this is a finding.

Check Content Reference

M

Target Key

5547