# Ensure world writable files and directories are secured

Necessity: World-writable files and directories pose a significant security risk. Any local user on the system can modify, replace, or delete these files. This can lead to privilege escalation if a privileged user or service executes a modified script, data corruption if a configuration file is altered, or the introduction of malware. Allowing world-writable permissions fundamentally breaks the principle of least privilege and compromises system integrity.

Auditing and Remediation: The audit script inventories the system by searching all local filesystems for files and directories with the world-writable permission bit set (`o+w`) and returns a total count. The remediation script performs the same search but then executes the `chmod o-w` command on each item found, effectively removing the insecure permission.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is an absolute count of 0. There is no acceptable baseline for having world-writable files on a production system. The security risk they introduce is immediate and severe. While some applications might create them temporarily, they should be addressed promptly. Any persistent world-writable file should be treated as a high-priority security finding, making zero the only acceptable secure state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that searches the entire system for world-writable files and directories, excluding those on separate filesystems. The script must return a single integer representing the total count of such items found, with no additional text or formatting.

## Remediation Script Working

Bash script that finds all world-writable files and directories on the system (excluding other filesystems) and removes the world-writable permission from them. The script must not accept any arguments. It must return 'true' if the operation completes successfully, and 'false' if any errors occur.

