>From cd6bdd96415d36b8c06c5e0f2c49efb4983c2e37 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Wed, 19 Sep 2012 12:11:46 -0400 Subject: [PATCH 08/14] Created OCIL for world_writable_files_system_ownership Modified description text, which already had manual check information, to create OCIL content --- RHEL6/input/system/permissions/files.xml | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index b82c024..afe6671 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -370,13 +370,14 @@ and the cause should be discovered and addressed. Ensure All World-Writable Directories Are Owned by a System Account Locate any directories in local partitions which are world-writable and ensure that they are owned by root or another -system account. The following command will discover and print these +system account. + The following command will discover and print these (assuming only system accounts have a uid lower than 500). Run it -once for each local partition PART: -
# find PART -xdev -type d -perm -0002 -uid +500 -print
+once for each local partition PART: +
# find PART -xdev -type d -perm -0002 -uid +500 -print
If this command produces any output, investigate why the current owner is not root or another system account. - +
Allowing a user account to own a world-writeable directory is undesirable because it allows the owner of that directory to remove -- 1.7.1