CIS 1.1.17

[BenoitLefebvre]

Current script only change /tmp

According to CIS document (https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.1.0.pdf)
The changes needs to be applied to ALL world-writable directory in the system.

[BenoitLefebvre]

Here is a quick Ruby implementation, I'm sure there are more elegant ways to do it.

world_writables = %x[ df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 -a ! -perm -1000 2>/dev/null ]

world_writables.each do |filename|
filename.chomp!
exec("chmod a+t #{filename}")
end

[jorritfolmer]

Puppifying the above Ruby from BenoitLefebvre would be something like this:

exec { "cis1_1_17":
  command => "df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null | xargs chmod a+t",
  path => ["/usr/bin", "/bin"],
  onlyif => "/usr/bin/test $(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 |wc -l) -gt 0",
}