BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-10-400140 RHEL 10 must be configured so that world-writable directories are owned by root, sys, bin, or an application user.

DISA STIG library V1R3
All changes in this version
first version loaded CAT II

Maps to SC-4 via CCI-001090

Title

RHEL 10 must be configured so that world-writable directories are owned by root, sys, bin, or an application user.

Control

Verify RHEL 10 world-writable directories are owned by root, a system account, or an application account with the following command: $ sudo find / -xdev -type d -perm -0002 -uid +999 -exec stat -c "%U, %u, %A, %n" {} \; 2>/dev/null If output indicates that world-writable directories are owned by any account other than root or an approved system account, this is a finding.

Discussion

If a world-writable directory is not owned by root, sys, bin, or an application user identifier (UID), unauthorized users may be able to modify files created by others. The only authorized public directories are temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.

Related controls

CCI-001090

Fix

Configure RHEL 10 public directories to be owned by root or a system account to prevent unauthorized and unintended information transferred via shared system resources. Use the following command template to set ownership of public directories to root or a system account: $ sudo chown [root or system account] [Public Directory]