Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

World writable tmp dir missing sticky bit CIS L1 v2.2.0 1.1.21 #199

Open
aberends opened this issue Apr 1, 2020 · 0 comments
Open

World writable tmp dir missing sticky bit CIS L1 v2.2.0 1.1.21 #199

aberends opened this issue Apr 1, 2020 · 0 comments

Comments

@aberends
Copy link

aberends commented Apr 1, 2020

After integrating telegram in Zabbix, our CIS L1 benchmarks shows that de directory zbxtg created by the zbxtg.py script is world writable and has no sticky bit. This is solvable by making a change in the main() function of zbxtg.py:

#os.chmod(tmp_dir, stat.S_IRWXU | stat.S_IRWXG | stat.S_IRWXO)
os.chmod(tmp_dir, stat.S_ISVTX | stat.S_IRWXU | stat.S_IRWXG | stat.S_IRWXO)

So, the change is adding the sticky bit mask stat.S_ISVTX to the list of other bits. I purposely prepended the list because the sticky bit has a higher number (512) compared to the other ones where the highest one is stat.S_IRWXU (448).

Keep up the good work! Hopefully you can add this fix. We tested sending out messages and everything still works okay after applying this fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant