Leave no world-writable file, and set the sticky bit on world-writable directories

Description

On local filesystems (ext2/3/4, XFS, Btrfs, JFS, F2FS, FAT, exFAT and tmpfs):

• no regular file is writable by others;
• every directory writable by others has the sticky bit (t), so that only the owner of a file can delete or rename it, as on /tmp.

Network filesystems and kernel pseudo-filesystems (/proc, /sys, /dev) are not scanned.

A fresh Debian 12 or 13 system has no finding. The scan stays on each filesystem (find -xdev) and takes a few seconds on a typical system, longer on file servers.

Rationale

A world-writable file can be modified by every account and every service: when it is a script, a configuration or data read by a privileged process, this leads to code execution or tampering. Without the sticky bit, any user can delete or replace other users' files in a shared directory and set traps for programs that use predictable names there.

Impact

Removing write access for others can break a badly packaged application that relies on it. Fix such cases with a dedicated group instead. Adding the sticky bit to a shared directory only stops users from deleting each other's files.

Audit

For each local filesystem listed by findmnt -knr -o TARGET -t ext2,ext3,ext4,xfs,btrfs,jfs,f2fs,vfat,exfat,tmpfs, run:

find <mount point> -xdev \( -type f -perm -0002 -o -type d -perm -0002 ! -perm -1000 \)

The command must print nothing.

Automated: every check must pass. Scanners report each check by its id.

world-writable

World-writable files and world-writable directories without the sticky bit on local filesystems.

script: |
  out=$(for m in $(findmnt -knr -o TARGET -t ext2,ext3,ext4,xfs,btrfs,jfs,f2fs,vfat,exfat,tmpfs); do
    find "$m" -xdev \( -type f -perm -0002 -o -type d -perm -0002 ! -perm -1000 \) -print 2>/dev/null
  done | sort -u)
  [ -z "$out" ] && { echo "no world-writable file, every world-writable directory is sticky"; exit 0; }
  echo "$(printf '%s\n' "$out" | wc -l) item(s):"
  printf '%s\n' "$out" | head -n 20
  exit 1

Remediation

For each reported item:

• directory: run chmod +t <directory>, or chmod o-w <directory> if it does not need to be shared;
• file: find which package or application owns it (dpkg -S <file>) and why it is writable, then run chmod o-w <file>, and give access through a group if some users still need it.

The automated fix only adds the sticky bit to directories; files are left for review.

Rollback

Run chmod -t <directory> on the directories listed by the audit before the fix.

sticky-bit

for m in $(findmnt -knr -o TARGET -t ext2,ext3,ext4,xfs,btrfs,jfs,f2fs,vfat,exfat,tmpfs); do
  find "$m" -xdev -type d -perm -0002 ! -perm -1000 -exec chmod +t {} + 2>/dev/null
done
exit 0

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• chmod(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• inode(7), Debian manual pages (sticky bit) Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R54) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-BOOT-006 Protect symbolic links in world-writable sticky directories

People and lifecycle