Ensure No World-Writable Files Exist
Verifies that the shared /tmp directory is not writable by other, the canary for the broader policy of having no unauthorized world-writable files.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Data in world-writable files and directories can be modified by any user on the system. An attacker (or a compromised low-privilege account) can tamper with content, plant scripts, or overwrite trusted data, eroding integrity. On a world-writable directory like /tmp the absence of the sticky bit is especially dangerous: any user could delete or rename another user's files. Legitimate access can almost always be granted through user/group permissions instead, without exposing the file to everyone.
What Pavois checks
Pavois reads the live mode of /tmp and asserts the world-write bit is not set. Note: a correctly hardened /tmp is typically 1777, world-writable with the sticky bit. Where this control fails, it signals /tmp was reconfigured insecurely (e.g. lost its protection) and serves as a representative check that the system's world-writable surface is controlled. Inspecting the effective inode beats parsing fstab or a manifest, which would not reflect a runtime chmod.
describe command('find / -xdev -type f -perm -0002 2>/dev/null | head -1') do
its('stdout') { should eq '' }
endHow to verify it is applied
Run stat -c '%a' /tmp (expect 1777, sticky bit set). To audit the whole system for stray world-writable files without the sticky bit: find / -xdev -type f -perm -0002 2>/dev/null (should return nothing) and find / -xdev -type d -perm -0002 ! -perm -1000 2>/dev/null for unprotected directories.
Inspect & investigate
There is no service log for permissions; audit on demand with the find commands above. If auditd watches the affected paths, related changes appear in /var/log/audit/audit.log. Package-shipped files that drifted show up via dpkg --verify or rpm -Va.
Remediation
No automated remediation ships for this rule. Restore /tmp with chmod 1777 /tmp, and remove the world-write bit from any offending file found by the find audit: chmod o-w <file> (or add the sticky bit to legitimately shared directories with chmod +t <dir>).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find / -xdev -type f -perm -0002 -exec chmod o-w {} + 2>/dev/null || true |
|---|---|
| name | fix-world-writable |
| not_if | test -z "$(find / -xdev -type f -perm -0002 2>/dev/null | head -1)" |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
World-writable files let any local user tamper with data and escalate footholds. Remediation is generally safe, but blindly stripping write bits can break applications that legitimately rely on a shared directory, review each find hit before changing it. For /tmp and /var/tmp, keep them world-writable with the sticky bit (1777); removing world-write entirely will break many programs that create temp files.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R54 | direct | 2.0 | high |
| CIS | 2.2.6, 7.1.11 | direct | per OS, see the benchmark table | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.