Profile Applicability:
Level 1

Description:
 World writable files and directories allow any user to modify or write to them, which can lead to unauthorized data modification, privilege escalation, or system compromise.

Rationale:
 Securing world writable files and directories reduces the risk of unauthorized access or malicious changes, helping maintain system integrity.

Impact:
 Pros:

  • Protects critical system and user files from unauthorized modifications.

  • Mitigates risk of privilege escalation via writable files.

Cons:

  • Restrictive permissions may impact legitimate multi-user workflows if not managed properly.

Default Value:
 World writable files and directories may exist due to default application configurations or misconfigurations.

Pre-requisites:

  • Root or sudo privileges to audit and modify file permissions.

Remediation:

Test Plan:

Using Linux command line:

  1. Find all world writable files:

    find / -xdev -type f -perm -0002 -print

  2. Find all world writable directories:

    find / -xdev -type d -perm -0002 -print

  3. Review and verify the necessity of these permissions.

Implementation Plan:

Using Linux command line:

  1. Remove world writable permission from files/directories where not needed:

    chmod o-w /path/to/file_or_directory

  2. For directories requiring sticky bit (e.g., /tmp), ensure sticky bit is set:

    chmod +t /path/to/directory

  3. Document changes and monitor permissions regularly.

Backout Plan:

Using Linux command line:

  1. Restore previous permissions from backups if needed.

  2. Communicate with users if permission changes impact functionality.

References: