# Ensure world writable files and directories are secured

Necessity: World-writable files and directories pose a significant security risk. Any user on the system can modify, delete, or replace such files. This can lead to unauthorized privilege escalation (e.g., by modifying a script executed by the root user), denial of service (by deleting a critical system file), or the introduction of malicious code. Ensuring no such files exist is a fundamental security hardening practice.

Auditing and Remediation: The audit script systematically scans the filesystem using commands like 'find' to identify any file or directory with permissions allowing 'others' to write to it (permission bit -002). The remediation script performs the same scan but then takes the corrective action of removing this permission bit (chmod o-w) from any identified items, thus securing them against unauthorized modification.

Recommended State Rationale: The recommended state for this control is 'Secured' across all levels (Basic, Moderate, and Strict). There is no acceptable level of risk associated with world-writable files. The presence of even a single misconfigured file can be exploited to compromise the entire system. Therefore, the security posture is binary: the system is either secured against this vulnerability or it is not. All hardening standards mandate the complete removal of world-writable permissions from system files and directories.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Secured']` |
| **Moderate** | `['Secured']` |
| **Strict** | `['Secured']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that scans all local filesystems for world-writable files and directories. The script must ignore common pseudo-filesystems (e.g., /proc, /sys, /dev, /run). The script must only return a single space-separated string containing the full paths of any non-compliant files or directories. If none are found, it must return an empty string.

## Remediation Script Working

shell script that accepts a single positional argument: the string 'enforce'. When executed with this argument, the script must find all world-writable files and directories on local filesystems and remove the world-writable permission bit ('o-w') from them. The script must return 'true' on successful completion of the operation and 'false' if an error is encountered.

