The sticky bit must be set on all world writable directories.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-48137	SOL-11.1-070010	SV-61009r1_rule		Medium

Description
Files in directories that have had the "sticky bit" enabled can only be deleted by users that have both write permissions for the directory in which the file resides, as well as ownership of the file or directory, or have sufficient privileges. As this prevents users from overwriting each others' files, whether it be accidental or malicious, it is generally appropriate for most world-writable directories (e.g., /tmp).

Description

Files in directories that have had the "sticky bit" enabled can only be deleted by users that have both write permissions for the directory in which the file resides, as well as ownership of the file or directory, or have sufficient privileges. As this prevents users from overwriting each others' files, whether it be accidental or malicious, it is generally appropriate for most world-writable directories (e.g., /tmp).

STIG	Date
Solaris 11 SPARC Security Technical Implementation Guide	2017-03-02

Details

Check Text ( C-50569r1_chk )
The root role is required. Identify all world-writable directories without the "sticky bit" set. # find / \( -fstype nfs -o -fstype cachefs -o -fstype autofs \ -o -fstype ctfs -o -fstype mntfs -o -fstype objfs \ -o -fstype proc \) -prune -o -type d \( -perm -0002 \ -a ! -perm -1000 \) -ls Output of this command identifies world-writable directories without the "sticky bit" set. If output is created, this is a finding.

Check Text ( C-50569r1_chk )

The root role is required.

Identify all world-writable directories without the "sticky bit" set.

# find / \( -fstype nfs -o -fstype cachefs -o -fstype autofs \
-o -fstype ctfs -o -fstype mntfs -o -fstype objfs \
-o -fstype proc \) -prune -o -type d \( -perm -0002 \
-a ! -perm -1000 \) -ls

Output of this command identifies world-writable directories without the "sticky bit" set. If output is created, this is a finding.

Fix Text (F-51745r1_fix)
The root role is required. Ensure that the "sticky bit" is set on any directories identified during the check steps. # chmod +t [directory name]