SSG 0.1-14-14 - world_writable_files_system_ownership

ssg fthfth ssgtesting1 at yahoo.com
Fri Feb 14 19:15:07 UTC 2014


For Ensure All World-Writable Directories Are Owned by a System Account - (CCE-26642-9), with either the stig-rhel6-server or the usgcb-rhel6-server profiles selected from the SCAP stream, when run with SCC 3.1.1.1, may produce a false-negative when running SCC 3.1.1.1 on a RHEL6V1R2 non-complaint machine.
The non-complaint system contains world-writable directories not owned by a system account:
/bin/ls -dn /root/
drwxrwxrwx. 28 500 500 4096 Feb  7 09:46 /root/
/bin/ls -dl /root/ && /bin/grep ^user: /etc/group /etc/passwd
drwxrwxrwx. 28 user user 4096 Jan  8 13:07 /root/
/etc/group:user:x:500:
/etc/passwd:user::500:500:user:/home/user:/bin/bash
See the following report output:
Ensure All World-Writable Directories Are Owned by a System Account
ID:  world_writable_files_system_ownership
Result:  Pass
Identities:  CCE-26642-9
Description:  All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group.
Fix Text:   
Severity:  low
Weight:   
Reference:  AC-6
Definitions:  
ID:  oval:ssg:def:521
Result:  true
Title:  Find world writable directories not owned by a system account
Description:  All world writable directories should be owned by a system user.
Class:  compliance
Tests:  

    true (All item-state comparisons must be true.) (negated)
        false (check for local directories that are world writable and have uid greater than or equal to 500)

Tests:  
Test ID:  oval:ssg:tst:522
Result:  false
Title:  check for local directories that are world writable and have uid greater than or equal to 500
Check Existence:  One or more collected items must exist.
Check:  All collected items must match the given state(s).
State Operator:  All item-state comparisons must be true.
Object ID:  oval:ssg:obj:1587
Object Requirements:  

    behavior requirements:
        recurse_direction = down
        recurse = directories
        recurse_file_system = local
    path must be equal to '/'
    filter must be equal to 'oval:ssg:ste:1588'

State ID:  oval:ssg:ste:1588
State Requirements:  

    user_id must be greater than or equal to '500'
    owrite must be equal to 'true'

Additional Information:  Collected items did not meet the check existence requirement.




More information about the scap-security-guide mailing list