The macOS system must be configured with all public directories owned by root or an application account.

From Apple OS X 10.13 Security Technical Implementation Guide

Associated with: CCI-000366

SV-96397r1_rule The macOS system must be configured with all public directories owned by root or an application account.

Vulnerability discussion

All public directories must be owned by "root", the local admin user, or an application account. Directory owners have permission to delete any files contained in that directory, even if the files are owned by other user accounts. By setting the owner to an administrator or application account, regular users will not be permitted to delete each other's files.

Check content

To display all directories that are writable by all and not owned by "root", run the following command: /usr/bin/sudo find / -type d -perm +o+w -not -uid 0 If anything is returned, and those directories are not owned by root or application account, this is a finding.

Fix text

To change the ownership of any finding, run the following command: /usr/bin/sudo find / -type d -perm +o+w -not -uid 0 -exec chown root {} \;

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.